policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 fs_list_cgroup_dirs($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 ssh_rw_stream_sockets($1_usertype)
 161                 ssh_delete_tmp($1_t)
 162                 ssh_signal($1_t)
 163         ')
 164 ')
 165
 166 #######################################
 167 ## <summary>
 168 ##      Allow a home directory for which the
 169 ##      role has read-only access.
 170 ## </summary>
 171 ## <desc>
 172 ##      <p>
 173 ##      Allow a home directory for which the
 174 ##      role has read-only access.
 175 ##      </p>
 176 ##      <p>
 177 ##      This does not allow execute access.
 178 ##      </p>
 179 ## </desc>
 180 ## <param name="role">
 181 ##      <summary>
 182 ##      The user role
 183 ##      </summary>
 184 ## </param>
 185 ## <param name="userdomain">
 186 ##      <summary>
 187 ##      The user domain
 188 ##      </summary>
 189 ## </param>
 190 ## <rolebase/>
 191 #
 192 interface(`userdom_ro_home_role',`
 193         gen_require(`
 194                 type user_home_t, user_home_dir_t;
 195         ')
 196
 197         role $1 types { user_home_t user_home_dir_t };
 198
 199         ##############################
 200         #
 201         # Domain access to home dir
 202         #
 203
 204         type_member $2 user_home_dir_t:dir user_home_dir_t;
 205
 206         # read-only home directory
 207         allow $2 user_home_dir_t:dir list_dir_perms;
 208         allow $2 user_home_t:dir list_dir_perms;
 209         allow $2 user_home_t:file entrypoint;
 210         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 213         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 214         files_list_home($2)
 215
 216 ')
 217
 218 #######################################
 219 ## <summary>
 220 ##      Allow a home directory for which the
 221 ##      role has full access.
 222 ## </summary>
 223 ## <desc>
 224 ##      <p>
 225 ##      Allow a home directory for which the
 226 ##      role has full access.
 227 ##      </p>
 228 ##      <p>
 229 ##      This does not allow execute access.
 230 ##      </p>
 231 ## </desc>
 232 ## <param name="role">
 233 ##      <summary>
 234 ##      The user role
 235 ##      </summary>
 236 ## </param>
 237 ## <param name="userdomain">
 238 ##      <summary>
 239 ##      The user domain
 240 ##      </summary>
 241 ## </param>
 242 ## <rolebase/>
 243 #
 244 interface(`userdom_manage_home_role',`
 245         gen_require(`
 246                 type user_home_t, user_home_dir_t;
 247                 attribute user_home_type;
 248         ')
 249
 250         role $1 types { user_home_type user_home_dir_t };
 251
 252         ##############################
 253         #
 254         # Domain access to home dir
 255         #
 256
 257         type_member $2 user_home_dir_t:dir user_home_dir_t;
 258
 259         # full control of the home directory
 260         allow $2 user_home_t:dir mounton;
 261         allow $2 user_home_t:file entrypoint;
 262
 263         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 264         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 265         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 276         files_list_home($2)
 277
 278         # cjp: this should probably be removed:
 279         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 280
 281         tunable_policy(`use_nfs_home_dirs',`
 282                 fs_mount_nfs($2)
 283                 fs_mounton_nfs($2)
 284                 fs_manage_nfs_dirs($2)
 285                 fs_manage_nfs_files($2)
 286                 fs_manage_nfs_symlinks($2)
 287                 fs_manage_nfs_named_sockets($2)
 288                 fs_manage_nfs_named_pipes($2)
 289         ')
 290
 291         tunable_policy(`use_samba_home_dirs',`
 292                 fs_mount_cifs($2)
 293                 fs_mounton_cifs($2)
 294                 fs_manage_cifs_dirs($2)
 295                 fs_manage_cifs_files($2)
 296                 fs_manage_cifs_symlinks($2)
 297                 fs_manage_cifs_named_sockets($2)
 298                 fs_manage_cifs_named_pipes($2)
 299         ')
 300 ')
 301
 302 #######################################
 303 ## <summary>
 304 ##      Manage user temporary files
 305 ## </summary>
 306 ## <param name="role">
 307 ##      <summary>
 308 ##      Role allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <param name="domain">
 312 ##      <summary>
 313 ##      Domain allowed access.
 314 ##      </summary>
 315 ## </param>
 316 ## <rolebase/>
 317 #
 318 interface(`userdom_manage_tmp_role',`
 319         gen_require(`
 320                 type user_tmp_t;
 321         ')
 322
 323         role $1 types user_tmp_t;
 324
 325         files_poly_member_tmp($2, user_tmp_t)
 326
 327         manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 328         manage_files_pattern($2, user_tmp_t, user_tmp_t)
 329         manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 330         manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 331         manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 332         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 333         relabel_files_pattern($2, user_tmp_t, user_tmp_t)
 334 ')
 335
 336 #######################################
 337 ## <summary>
 338 ##      Dontaudit search of user bin dirs.
 339 ## </summary>
 340 ## <param name="domain">
 341 ##      <summary>
 342 ##      Domain to not audit.
 343 ##      </summary>
 344 ## </param>
 345 #
 346 interface(`userdom_dontaudit_search_user_bin_dirs',`
 347         gen_require(`
 348                 type home_bin_t;
 349         ')
 350
 351         dontaudit $1 home_bin_t:dir search_dir_perms;
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Execute user bin files.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain allowed access.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_exec_user_bin_files',`
 365         gen_require(`
 366                 attribute user_home_type;
 367                 type home_bin_t, user_home_dir_t;
 368         ')
 369
 370         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 371         files_search_home($1)
 372 ')
 373
 374 #######################################
 375 ## <summary>
 376 ##      The execute access user temporary files.
 377 ## </summary>
 378 ## <param name="domain">
 379 ##      <summary>
 380 ##      Domain allowed access.
 381 ##      </summary>
 382 ## </param>
 383 ## <rolebase/>
 384 #
 385 interface(`userdom_exec_user_tmp_files',`
 386         gen_require(`
 387                 type user_tmp_t;
 388         ')
 389
 390         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 391         dontaudit $1 user_tmp_t:sock_file execute;
 392         files_search_tmp($1)
 393 ')
 394
 395 #######################################
 396 ## <summary>
 397 ##      Role access for the user tmpfs type
 398 ##      that the user has full access.
 399 ## </summary>
 400 ## <desc>
 401 ##      <p>
 402 ##      Role access for the user tmpfs type
 403 ##      that the user has full access.
 404 ##      </p>
 405 ##      <p>
 406 ##      This does not allow execute access.
 407 ##      </p>
 408 ## </desc>
 409 ## <param name="role">
 410 ##      <summary>
 411 ##      Role allowed access.
 412 ##      </summary>
 413 ## </param>
 414 ## <param name="domain">
 415 ##      <summary>
 416 ##      Domain allowed access.
 417 ##      </summary>
 418 ## </param>
 419 ## <rolecap/>
 420 #
 421 interface(`userdom_manage_tmpfs_role',`
 422         gen_require(`
 423                 type user_tmpfs_t;
 424         ')
 425
 426         role $1 types user_tmpfs_t;
 427
 428         manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
 429         manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 430         manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 431         manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 432         manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 433         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 434 ')
 435
 436 #######################################
 437 ## <summary>
 438 ##      The interface allowing the user basic
 439 ##      network permissions
 440 ## </summary>
 441 ## <param name="userdomain">
 442 ##      <summary>
 443 ##      The user domain
 444 ##      </summary>
 445 ## </param>
 446 ## <rolebase/>
 447 #
 448 interface(`userdom_basic_networking',`
 449
 450         allow $1 self:tcp_socket create_stream_socket_perms;
 451         allow $1 self:udp_socket create_socket_perms;
 452
 453         corenet_all_recvfrom_unlabeled($1)
 454         corenet_all_recvfrom_netlabel($1)
 455         corenet_tcp_sendrecv_generic_if($1)
 456         corenet_udp_sendrecv_generic_if($1)
 457         corenet_tcp_sendrecv_generic_node($1)
 458         corenet_udp_sendrecv_generic_node($1)
 459         corenet_tcp_sendrecv_all_ports($1)
 460         corenet_udp_sendrecv_all_ports($1)
 461         corenet_tcp_connect_all_ports($1)
 462         corenet_sendrecv_all_client_packets($1)
 463
 464         optional_policy(`
 465                 init_tcp_recvfrom_all_daemons($1)
 466                 init_udp_recvfrom_all_daemons($1)
 467         ')
 468
 469         optional_policy(`
 470                 ipsec_match_default_spd($1)
 471         ')
 472
 473 ')
 474
 475 #######################################
 476 ## <summary>
 477 ##      The template for creating a user xwindows client.  (Deprecated)
 478 ## </summary>
 479 ## <param name="userdomain_prefix">
 480 ##      <summary>
 481 ##      The prefix of the user domain (e.g., user
 482 ##      is the prefix for user_t).
 483 ##      </summary>
 484 ## </param>
 485 ## <rolebase/>
 486 #
 487 template(`userdom_xwindows_client_template',`
 488         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 489         gen_require(`
 490                 type $1_t, user_tmpfs_t;
 491         ')
 492
 493         dev_rw_xserver_misc($1_t)
 494         dev_rw_power_management($1_t)
 495         dev_read_input($1_t)
 496         dev_read_misc($1_t)
 497         dev_write_misc($1_t)
 498         # open office is looking for the following
 499         dev_getattr_agp_dev($1_t)
 500         dev_dontaudit_rw_dri($1_t)
 501         # GNOME checks for usb and other devices:
 502         dev_rw_usbfs($1_t)
 503         dev_rw_generic_usb_dev($1_t)
 504
 505         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 506         xserver_xsession_entry_type($1_t)
 507         xserver_dontaudit_write_log($1_t)
 508         xserver_stream_connect_xdm($1_t)
 509         # certain apps want to read xdm.pid file
 510         xserver_read_xdm_pid($1_t)
 511         # gnome-session creates socket under /tmp/.ICE-unix/
 512         xserver_create_xdm_tmp_sockets($1_t)
 513         # Needed for escd, remove if we get escd policy
 514         xserver_manage_xdm_tmp_files($1_t)
 515 ')
 516
 517 #######################################
 518 ## <summary>
 519 ##      The template for allowing the user to change passwords.
 520 ## </summary>
 521 ## <param name="userdomain_prefix">
 522 ##      <summary>
 523 ##      The prefix of the user domain (e.g., user
 524 ##      is the prefix for user_t).
 525 ##      </summary>
 526 ## </param>
 527 ## <rolebase/>
 528 #
 529 template(`userdom_change_password_template',`
 530         gen_require(`
 531                 type $1_t;
 532                 role $1_r;
 533         ')
 534
 535         optional_policy(`
 536                 usermanage_run_chfn($1_t,$1_r)
 537                 usermanage_run_passwd($1_t,$1_r)
 538         ')
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template containing rules common to unprivileged
 544 ##      users and administrative users.
 545 ## </summary>
 546 ## <desc>
 547 ##      <p>
 548 ##      This template creates a user domain, types, and
 549 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 550 ##      </p>
 551 ## </desc>
 552 ## <param name="userdomain_prefix">
 553 ##      <summary>
 554 ##      The prefix of the user domain (e.g., user
 555 ##      is the prefix for user_t).
 556 ##      </summary>
 557 ## </param>
 558 #
 559 template(`userdom_common_user_template',`
 560         gen_require(`
 561                 attribute unpriv_userdomain;
 562         ')
 563
 564         userdom_basic_networking($1_usertype)
 565
 566         ##############################
 567         #
 568         # User domain Local policy
 569         #
 570
 571         # evolution and gnome-session try to create a netlink socket
 572         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 573         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 574         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 575         allow $1_t self:socket create_socket_perms;
 576
 577         allow $1_usertype unpriv_userdomain:fd use;
 578
 579         kernel_read_system_state($1_usertype)
 580         kernel_read_network_state($1_usertype)
 581         kernel_read_software_raid_state($1_usertype)
 582         kernel_read_net_sysctls($1_usertype)
 583         # Very permissive allowing every domain to see every type:
 584         kernel_get_sysvipc_info($1_usertype)
 585         # Find CDROM devices:
 586         kernel_read_device_sysctls($1_usertype)
 587         kernel_request_load_module($1_usertype)
 588
 589         corenet_udp_bind_generic_node($1_usertype)
 590         corenet_udp_bind_generic_port($1_usertype)
 591
 592         dev_read_rand($1_usertype)
 593         dev_write_sound($1_usertype)
 594         dev_read_sound($1_usertype)
 595         dev_read_sound_mixer($1_usertype)
 596         dev_write_sound_mixer($1_usertype)
 597
 598         files_exec_etc_files($1_usertype)
 599         files_search_locks($1_usertype)
 600         # Check to see if cdrom is mounted
 601         files_search_mnt($1_usertype)
 602         # cjp: perhaps should cut back on file reads:
 603         files_read_var_files($1_usertype)
 604         files_read_var_symlinks($1_usertype)
 605         files_read_generic_spool($1_usertype)
 606         files_read_var_lib_files($1_usertype)
 607         # Stat lost+found.
 608         files_getattr_lost_found_dirs($1_usertype)
 609         files_read_config_files($1_usertype)
 610         fs_read_noxattr_fs_files($1_usertype)
 611         fs_read_noxattr_fs_symlinks($1_usertype)
 612         fs_rw_cgroup_files($1_usertype)
 613
 614         application_getattr_socket($1_usertype)
 615
 616         logging_send_syslog_msg($1_usertype)
 617         logging_send_audit_msgs($1_usertype)
 618         selinux_get_enforce_mode($1_usertype)
 619
 620         # cjp: some of this probably can be removed
 621         selinux_get_fs_mount($1_usertype)
 622         selinux_validate_context($1_usertype)
 623         selinux_compute_access_vector($1_usertype)
 624         selinux_compute_create_context($1_usertype)
 625         selinux_compute_relabel_context($1_usertype)
 626         selinux_compute_user_contexts($1_usertype)
 627
 628         # for eject
 629         storage_getattr_fixed_disk_dev($1_usertype)
 630
 631         auth_read_login_records($1_usertype)
 632         auth_run_pam($1_t,$1_r)
 633         auth_run_utempter($1_t,$1_r)
 634
 635         init_read_utmp($1_usertype)
 636
 637         seutil_read_file_contexts($1_usertype)
 638         seutil_read_default_contexts($1_usertype)
 639         seutil_run_newrole($1_t,$1_r)
 640         seutil_exec_checkpolicy($1_t)
 641         seutil_exec_setfiles($1_usertype)
 642         # for when the network connection is killed
 643         # this is needed when a login role can change
 644         # to this one.
 645         seutil_dontaudit_signal_newrole($1_t)
 646
 647         tunable_policy(`user_direct_mouse',`
 648                 dev_read_mouse($1_usertype)
 649         ')
 650
 651         tunable_policy(`user_ttyfile_stat',`
 652                 term_getattr_all_ttys($1_t)
 653         ')
 654
 655         optional_policy(`
 656                 alsa_read_rw_config($1_usertype)
 657                 alsa_manage_home_files($1_t)
 658                 alsa_relabel_home_files($1_t)
 659         ')
 660
 661         optional_policy(`
 662                 # Allow graphical boot to check battery lifespan
 663                 apm_stream_connect($1_usertype)
 664         ')
 665
 666         optional_policy(`
 667                 canna_stream_connect($1_usertype)
 668         ')
 669
 670         optional_policy(`
 671                 chrome_role($1_r, $1_usertype)
 672         ')
 673
 674         optional_policy(`
 675                 colord_read_lib_files($1_usertype)
 676         ')
 677
 678         optional_policy(`
 679                 dbus_system_bus_client($1_usertype)
 680
 681                 allow $1_usertype $1_usertype:dbus  send_msg;
 682
 683                 optional_policy(`
 684                         avahi_dbus_chat($1_usertype)
 685                 ')
 686
 687                 optional_policy(`
 688                         policykit_dbus_chat($1_usertype)
 689                 ')
 690
 691                 optional_policy(`
 692                         bluetooth_dbus_chat($1_usertype)
 693                 ')
 694
 695                 optional_policy(`
 696                         consolekit_dbus_chat($1_usertype)
 697                         consolekit_read_log($1_usertype)
 698                 ')
 699
 700                 optional_policy(`
 701                         devicekit_dbus_chat($1_usertype)
 702                         devicekit_dbus_chat_power($1_usertype)
 703                         devicekit_dbus_chat_disk($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         evolution_dbus_chat($1_usertype)
 708                         evolution_alarm_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         gnome_dbus_chat_gconfdefault($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         hal_dbus_chat($1_usertype)
 717                 ')
 718
 719                 optional_policy(`
 720                         kde_dbus_chat_backlighthelper($1_usertype)
 721                 ')
 722
 723                 optional_policy(`
 724                         modemmanager_dbus_chat($1_usertype)
 725                 ')
 726
 727                 optional_policy(`
 728                         networkmanager_dbus_chat($1_usertype)
 729                         networkmanager_read_lib_files($1_usertype)
 730                 ')
 731
 732                 optional_policy(`
 733                         vpn_dbus_chat($1_usertype)
 734                 ')
 735         ')
 736
 737         optional_policy(`
 738                 git_session_role($1_r, $1_usertype)
 739         ')
 740
 741         optional_policy(`
 742                 inetd_use_fds($1_usertype)
 743                 inetd_rw_tcp_sockets($1_usertype)
 744         ')
 745
 746         optional_policy(`
 747                 inn_read_config($1_usertype)
 748                 inn_read_news_lib($1_usertype)
 749                 inn_read_news_spool($1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 lircd_stream_connect($1_usertype)
 754         ')
 755
 756         optional_policy(`
 757                 locate_read_lib_files($1_usertype)
 758         ')
 759
 760         # for running depmod as part of the kernel packaging process
 761         optional_policy(`
 762                 modutils_read_module_config($1_usertype)
 763         ')
 764
 765         optional_policy(`
 766                 mta_rw_spool($1_usertype)
 767                 mta_manage_queue($1_usertype)
 768                 mta_filetrans_home_content($1_usertype)
 769         ')
 770
 771         optional_policy(`
 772                 nsplugin_role($1_r, $1_usertype)
 773         ')
 774
 775         optional_policy(`
 776                 tunable_policy(`allow_user_mysql_connect',`
 777                         mysql_stream_connect($1_t)
 778                 ')
 779         ')
 780
 781         optional_policy(`
 782                 oident_manage_user_content($1_t)
 783                 oident_relabel_user_content($1_t)
 784         ')
 785
 786         optional_policy(`
 787                 # to allow monitoring of pcmcia status
 788                 pcmcia_read_pid($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 pcscd_read_pub_files($1_usertype)
 793                 pcscd_stream_connect($1_usertype)
 794         ')
 795
 796         optional_policy(`
 797                 tunable_policy(`allow_user_postgresql_connect',`
 798                         postgresql_stream_connect($1_usertype)
 799                         postgresql_tcp_connect($1_usertype)
 800                 ')
 801         ')
 802
 803         optional_policy(`
 804                 resmgr_stream_connect($1_usertype)
 805         ')
 806
 807         optional_policy(`
 808                 rpc_dontaudit_getattr_exports($1_usertype)
 809                 rpc_manage_nfs_rw_content($1_usertype)
 810         ')
 811
 812         optional_policy(`
 813                 rpcbind_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 samba_stream_connect_winbind($1_usertype)
 818         ')
 819
 820         optional_policy(`
 821                 sandbox_transition($1_usertype, $1_r)
 822         ')
 823
 824         optional_policy(`
 825                 seunshare_role_template($1, $1_r, $1_t)
 826         ')
 827
 828         optional_policy(`
 829                 slrnpull_search_spool($1_usertype)
 830         ')
 831
 832 ')
 833
 834 #######################################
 835 ## <summary>
 836 ##      The template for creating a login user.
 837 ## </summary>
 838 ## <desc>
 839 ##      <p>
 840 ##      This template creates a user domain, types, and
 841 ##      rules for the user's tty, pty, home directories,
 842 ##      tmp, and tmpfs files.
 843 ##      </p>
 844 ## </desc>
 845 ## <param name="userdomain_prefix">
 846 ##      <summary>
 847 ##      The prefix of the user domain (e.g., user
 848 ##      is the prefix for user_t).
 849 ##      </summary>
 850 ## </param>
 851 #
 852 template(`userdom_login_user_template', `
 853         gen_require(`
 854                 class context contains;
 855         ')
 856
 857         userdom_base_user_template($1)
 858
 859         userdom_manage_home_role($1_r, $1_usertype)
 860
 861         userdom_manage_tmp_role($1_r, $1_usertype)
 862         userdom_manage_tmpfs_role($1_r, $1_usertype)
 863
 864         ifelse(`$1',`unconfined',`',`
 865                 gen_tunable(allow_$1_exec_content, true)
 866
 867                 tunable_policy(`allow_$1_exec_content',`
 868                         userdom_exec_user_tmp_files($1_usertype)
 869                         userdom_exec_user_home_content_files($1_usertype)
 870                 ')
 871                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 872                         fs_exec_nfs_files($1_usertype)
 873                 ')
 874
 875                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 876                         fs_exec_cifs_files($1_usertype)
 877                 ')
 878         ')
 879
 880         userdom_change_password_template($1)
 881
 882         ##############################
 883         #
 884         # User domain Local policy
 885         #
 886
 887         allow $1_t self:capability { setgid chown fowner };
 888         dontaudit $1_t self:capability { sys_nice fsetid };
 889
 890         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 891         dontaudit $1_t self:process setrlimit;
 892         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 893
 894         allow $1_t self:context contains;
 895
 896         kernel_dontaudit_read_system_state($1_usertype)
 897         kernel_dontaudit_list_all_proc($1_usertype)
 898
 899         dev_read_sysfs($1_usertype)
 900         dev_read_urand($1_usertype)
 901
 902         domain_use_interactive_fds($1_usertype)
 903         # Command completion can fire hundreds of denials
 904         domain_dontaudit_exec_all_entry_files($1_usertype)
 905
 906         files_dontaudit_list_default($1_usertype)
 907         files_dontaudit_read_default_files($1_usertype)
 908         # Stat lost+found.
 909         files_getattr_lost_found_dirs($1_usertype)
 910
 911         fs_get_all_fs_quotas($1_usertype)
 912         fs_getattr_all_fs($1_usertype)
 913         fs_search_all($1_usertype)
 914         fs_list_inotifyfs($1_usertype)
 915         fs_rw_anon_inodefs_files($1_usertype)
 916
 917         auth_dontaudit_write_login_records($1_t)
 918         auth_rw_cache($1_t)
 919
 920         # Stop warnings about access to /dev/console
 921         init_dontaudit_use_fds($1_usertype)
 922         init_dontaudit_use_script_fds($1_usertype)
 923
 924         libs_exec_lib_files($1_usertype)
 925
 926         logging_dontaudit_getattr_all_logs($1_usertype)
 927
 928         # for running TeX programs
 929         miscfiles_read_tetex_data($1_usertype)
 930         miscfiles_exec_tetex_data($1_usertype)
 931
 932         seutil_read_config($1_usertype)
 933
 934         optional_policy(`
 935                 cups_read_config($1_usertype)
 936                 cups_stream_connect($1_usertype)
 937                 cups_stream_connect_ptal($1_usertype)
 938         ')
 939
 940         optional_policy(`
 941                 kerberos_use($1_usertype)
 942                 kerberos_filetrans_home_content($1_usertype)
 943         ')
 944
 945         optional_policy(`
 946                 mta_dontaudit_read_spool_symlinks($1_usertype)
 947         ')
 948
 949         optional_policy(`
 950                 quota_dontaudit_getattr_db($1_usertype)
 951         ')
 952
 953         optional_policy(`
 954                 rpm_read_db($1_usertype)
 955                 rpm_dontaudit_manage_db($1_usertype)
 956                 rpm_read_cache($1_usertype)
 957         ')
 958
 959         optional_policy(`
 960                 oddjob_run_mkhomedir($1_t, $1_r)
 961         ')
 962 ')
 963
 964 #######################################
 965 ## <summary>
 966 ##      The template for creating a unprivileged login user.
 967 ## </summary>
 968 ## <desc>
 969 ##      <p>
 970 ##      This template creates a user domain, types, and
 971 ##      rules for the user's tty, pty, home directories,
 972 ##      tmp, and tmpfs files.
 973 ##      </p>
 974 ## </desc>
 975 ## <param name="userdomain_prefix">
 976 ##      <summary>
 977 ##      The prefix of the user domain (e.g., user
 978 ##      is the prefix for user_t).
 979 ##      </summary>
 980 ## </param>
 981 #
 982 template(`userdom_restricted_user_template',`
 983         gen_require(`
 984                 attribute unpriv_userdomain;
 985         ')
 986
 987         userdom_login_user_template($1)
 988
 989         typeattribute $1_t unpriv_userdomain;
 990         domain_interactive_fd($1_t)
 991
 992         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
 993         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
 994
 995         ##############################
 996         #
 997         # Local policy
 998         #
 999
1000         optional_policy(`
1001                 loadkeys_run($1_t,$1_r)
1002         ')
1003 ')
1004
1005 #######################################
1006 ## <summary>
1007 ##      The template for creating a unprivileged xwindows login user.
1008 ## </summary>
1009 ## <desc>
1010 ##      <p>
1011 ##      The template for creating a unprivileged xwindows login user.
1012 ##      </p>
1013 ##      <p>
1014 ##      This template creates a user domain, types, and
1015 ##      rules for the user's tty, pty, home directories,
1016 ##      tmp, and tmpfs files.
1017 ##      </p>
1018 ## </desc>
1019 ## <param name="userdomain_prefix">
1020 ##      <summary>
1021 ##      The prefix of the user domain (e.g., user
1022 ##      is the prefix for user_t).
1023 ##      </summary>
1024 ## </param>
1025 #
1026 template(`userdom_restricted_xwindows_user_template',`
1027
1028         userdom_restricted_user_template($1)
1029
1030         ##############################
1031         #
1032         # Local policy
1033         #
1034
1035         auth_role($1_r, $1_t)
1036         auth_search_pam_console_data($1_usertype)
1037         auth_dontaudit_read_login_records($1_usertype)
1038
1039         dev_read_sound($1_usertype)
1040         dev_write_sound($1_usertype)
1041         # gnome keyring wants to read this.
1042         dev_dontaudit_read_rand($1_usertype)
1043         # temporarily allow since openoffice requires this
1044         dev_read_rand($1_usertype)
1045
1046         dev_read_video_dev($1_usertype)
1047         dev_write_video_dev($1_usertype)
1048         dev_rw_wireless($1_usertype)
1049
1050         libs_dontaudit_setattr_lib_files($1_usertype)
1051
1052         tunable_policy(`user_rw_noexattrfile',`
1053                 dev_rw_usbfs($1_t)
1054                 dev_rw_generic_usb_dev($1_usertype)
1055
1056                 fs_manage_noxattr_fs_files($1_usertype)
1057                 fs_manage_noxattr_fs_dirs($1_usertype)
1058                 fs_manage_dos_dirs($1_usertype)
1059                 fs_manage_dos_files($1_usertype)
1060                 storage_raw_read_removable_device($1_usertype)
1061                 storage_raw_write_removable_device($1_usertype)
1062         ')
1063
1064         logging_send_syslog_msg($1_usertype)
1065         logging_dontaudit_send_audit_msgs($1_t)
1066
1067         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1068         logging_send_audit_msgs($1_t)
1069         selinux_get_enforce_mode($1_t)
1070         seutil_exec_restorecond($1_t)
1071         seutil_read_file_contexts($1_t)
1072         seutil_read_default_contexts($1_t)
1073
1074         xserver_restricted_role($1_r, $1_t)
1075
1076         optional_policy(`
1077                 alsa_read_rw_config($1_usertype)
1078         ')
1079
1080          # cjp: needed by KDE apps
1081          # bug: #682499
1082          optional_policy(`
1083                 gnome_read_usr_config($1_usertype)
1084                 gnome_role_gkeyringd($1, $1_r, $1_t)
1085                 # cjp: telepathy F15 bugs
1086                 telepathy_dbus_session_role($1_r, $1_t, $1)
1087         ')
1088
1089         optional_policy(`
1090                 dbus_role_template($1, $1_r, $1_usertype)
1091                 dbus_system_bus_client($1_usertype)
1092                 allow $1_usertype $1_usertype:dbus send_msg;
1093
1094                 optional_policy(`
1095                         abrt_dbus_chat($1_usertype)
1096                         abrt_run_helper($1_usertype, $1_r)
1097                 ')
1098
1099                 optional_policy(`
1100                         consolekit_dontaudit_read_log($1_usertype)
1101                         consolekit_dbus_chat($1_usertype)
1102                 ')
1103
1104                 optional_policy(`
1105                         cups_dbus_chat($1_usertype)
1106                         cups_dbus_chat_config($1_usertype)
1107                 ')
1108
1109                 optional_policy(`
1110                         devicekit_dbus_chat($1_usertype)
1111                         devicekit_dbus_chat_disk($1_usertype)
1112                         devicekit_dbus_chat_power($1_usertype)
1113                 ')
1114
1115                 optional_policy(`
1116                         fprintd_dbus_chat($1_t)
1117                 ')
1118         ')
1119
1120         optional_policy(`
1121                 openoffice_role_template($1, $1_r, $1_usertype)
1122         ')
1123
1124         optional_policy(`
1125                 policykit_role($1_r, $1_usertype)
1126         ')
1127
1128         optional_policy(`
1129                 pulseaudio_role($1_r, $1_usertype)
1130         ')
1131
1132         optional_policy(`
1133                 rtkit_scheduled($1_usertype)
1134         ')
1135
1136         optional_policy(`
1137                 setroubleshoot_dontaudit_stream_connect($1_t)
1138         ')
1139
1140         optional_policy(`
1141                 udev_read_db($1_usertype)
1142         ')
1143
1144         optional_policy(`
1145                 wm_role_template($1, $1_r, $1_t)
1146         ')
1147 ')
1148
1149 #######################################
1150 ## <summary>
1151 ##      The template for creating a unprivileged user roughly
1152 ##      equivalent to a regular linux user.
1153 ## </summary>
1154 ## <desc>
1155 ##      <p>
1156 ##      The template for creating a unprivileged user roughly
1157 ##      equivalent to a regular linux user.
1158 ##      </p>
1159 ##      <p>
1160 ##      This template creates a user domain, types, and
1161 ##      rules for the user's tty, pty, home directories,
1162 ##      tmp, and tmpfs files.
1163 ##      </p>
1164 ## </desc>
1165 ## <param name="userdomain_prefix">
1166 ##      <summary>
1167 ##      The prefix of the user domain (e.g., user
1168 ##      is the prefix for user_t).
1169 ##      </summary>
1170 ## </param>
1171 #
1172 template(`userdom_unpriv_user_template', `
1173
1174         ##############################
1175         #
1176         # Declarations
1177         #
1178
1179         # Inherit rules for ordinary users.
1180         userdom_restricted_xwindows_user_template($1)
1181         userdom_common_user_template($1)
1182
1183         ##############################
1184         #
1185         # Local policy
1186         #
1187
1188         # port access is audited even if dac would not have allowed it, so dontaudit it here
1189 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1190         # Need the following rule to allow users to run vpnc
1191         corenet_tcp_bind_xserver_port($1_t)
1192         corenet_tcp_bind_generic_node($1_usertype)
1193
1194         storage_rw_fuse($1_t)
1195
1196         miscfiles_read_hwdata($1_usertype)
1197
1198         # Allow users to run TCP servers (bind to ports and accept connection from
1199         # the same domain and outside users) disabling this forces FTP passive mode
1200         # and may change other protocols
1201
1202         tunable_policy(`user_share_music',`
1203                 corenet_tcp_bind_daap_port($1_usertype)
1204         ')
1205
1206         tunable_policy(`user_tcp_server',`
1207                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1208         ')
1209
1210         tunable_policy(`user_setrlimit',`
1211                 allow $1_usertype self:process setrlimit;
1212         ')
1213
1214         optional_policy(`
1215                 cdrecord_role($1_r, $1_t)
1216         ')
1217
1218         optional_policy(`
1219                 cron_role($1_r, $1_t)
1220         ')
1221
1222         optional_policy(`
1223                 games_rw_data($1_usertype)
1224         ')
1225
1226         optional_policy(`
1227                 gpg_role($1_r, $1_usertype)
1228         ')
1229
1230         optional_policy(`
1231                 gnomeclock_dbus_chat($1_t)
1232         ')
1233
1234         optional_policy(`
1235                 gpm_stream_connect($1_usertype)
1236         ')
1237
1238         optional_policy(`
1239                 execmem_role_template($1, $1_r, $1_t)
1240         ')
1241
1242         optional_policy(`
1243                 java_role_template($1, $1_r, $1_t)
1244         ')
1245
1246         optional_policy(`
1247                 mono_role_template($1, $1_r, $1_t)
1248         ')
1249
1250         optional_policy(`
1251                 mount_run_fusermount($1_t, $1_r)
1252                 mount_read_pid_files($1_t)
1253         ')
1254
1255         optional_policy(`
1256                 wine_role_template($1, $1_r, $1_t)
1257         ')
1258
1259         optional_policy(`
1260                 postfix_run_postdrop($1_t, $1_r)
1261         ')
1262
1263         # Run pppd in pppd_t by default for user
1264         optional_policy(`
1265                 ppp_run_cond($1_t, $1_r)
1266         ')
1267 ')
1268
1269 #######################################
1270 ## <summary>
1271 ##      The template for creating an administrative user.
1272 ## </summary>
1273 ## <desc>
1274 ##      <p>
1275 ##      This template creates a user domain, types, and
1276 ##      rules for the user's tty, pty, home directories,
1277 ##      tmp, and tmpfs files.
1278 ##      </p>
1279 ##      <p>
1280 ##      The privileges given to administrative users are:
1281 ##      <ul>
1282 ##              <li>Raw disk access</li>
1283 ##              <li>Set all sysctls</li>
1284 ##              <li>All kernel ring buffer controls</li>
1285 ##              <li>Create, read, write, and delete all files but shadow</li>
1286 ##              <li>Manage source and binary format SELinux policy</li>
1287 ##              <li>Run insmod</li>
1288 ##      </ul>
1289 ##      </p>
1290 ## </desc>
1291 ## <param name="userdomain_prefix">
1292 ##      <summary>
1293 ##      The prefix of the user domain (e.g., sysadm
1294 ##      is the prefix for sysadm_t).
1295 ##      </summary>
1296 ## </param>
1297 #
1298 template(`userdom_admin_user_template',`
1299         gen_require(`
1300                 attribute admindomain;
1301                 class passwd { passwd chfn chsh rootok crontab };
1302         ')
1303
1304         ##############################
1305         #
1306         # Declarations
1307         #
1308
1309         # Inherit rules for ordinary users.
1310         userdom_login_user_template($1)
1311         userdom_common_user_template($1)
1312
1313         domain_obj_id_change_exemption($1_t)
1314         role system_r types $1_t;
1315
1316         typeattribute $1_t admindomain;
1317
1318         ifdef(`direct_sysadm_daemon',`
1319                 domain_system_change_exemption($1_t)
1320         ')
1321
1322         ##############################
1323         #
1324         # $1_t local policy
1325         #
1326
1327         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1328         allow $1_t self:capability2 syslog;
1329         allow $1_t self:process { setexec setfscreate };
1330         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1331         allow $1_t self:tun_socket create;
1332         # Set password information for other users.
1333         allow $1_t self:passwd { passwd chfn chsh };
1334         # Skip authentication when pam_rootok is specified.
1335         allow $1_t self:passwd rootok;
1336
1337         # Manipulate other users crontab.
1338         allow $1_t self:passwd crontab;
1339
1340         kernel_read_software_raid_state($1_t)
1341         kernel_getattr_core_if($1_t)
1342         kernel_getattr_message_if($1_t)
1343         kernel_change_ring_buffer_level($1_t)
1344         kernel_clear_ring_buffer($1_t)
1345         kernel_read_ring_buffer($1_t)
1346         kernel_get_sysvipc_info($1_t)
1347         kernel_rw_all_sysctls($1_t)
1348         # signal unlabeled processes:
1349         kernel_kill_unlabeled($1_t)
1350         kernel_signal_unlabeled($1_t)
1351         kernel_sigstop_unlabeled($1_t)
1352         kernel_signull_unlabeled($1_t)
1353         kernel_sigchld_unlabeled($1_t)
1354         kernel_signal($1_t)
1355
1356         corenet_tcp_bind_generic_port($1_t)
1357         # allow setting up tunnels
1358         corenet_rw_tun_tap_dev($1_t)
1359
1360         dev_getattr_generic_blk_files($1_t)
1361         dev_getattr_generic_chr_files($1_t)
1362         # for lsof
1363         dev_getattr_mtrr_dev($1_t)
1364         # Allow MAKEDEV to work
1365         dev_create_all_blk_files($1_t)
1366         dev_create_all_chr_files($1_t)
1367         dev_delete_all_blk_files($1_t)
1368         dev_delete_all_chr_files($1_t)
1369         dev_rename_all_blk_files($1_t)
1370         dev_rename_all_chr_files($1_t)
1371         dev_create_generic_symlinks($1_t)
1372         dev_rw_generic_usb_dev($1_t)
1373         dev_rw_usbfs($1_t)
1374
1375         domain_setpriority_all_domains($1_t)
1376         domain_read_all_domains_state($1_t)
1377         domain_getattr_all_domains($1_t)
1378         domain_getcap_all_domains($1_t)
1379         domain_dontaudit_ptrace_all_domains($1_t)
1380         # signal all domains:
1381         domain_kill_all_domains($1_t)
1382         domain_signal_all_domains($1_t)
1383         domain_signull_all_domains($1_t)
1384         domain_sigstop_all_domains($1_t)
1385         domain_sigstop_all_domains($1_t)
1386         domain_sigchld_all_domains($1_t)
1387         # for lsof
1388         domain_getattr_all_sockets($1_t)
1389         domain_dontaudit_getattr_all_sockets($1_t)
1390
1391         files_exec_usr_src_files($1_t)
1392
1393         fs_getattr_all_fs($1_t)
1394         fs_getattr_all_files($1_t)
1395         fs_list_all($1_t)
1396         fs_set_all_quotas($1_t)
1397         fs_exec_noxattr($1_t)
1398
1399         storage_raw_read_removable_device($1_t)
1400         storage_raw_write_removable_device($1_t)
1401         storage_dontaudit_read_fixed_disk($1_t)
1402
1403         term_use_all_inherited_terms($1_t)
1404
1405         auth_getattr_shadow($1_t)
1406         # Manage almost all files
1407         auth_manage_all_files_except_shadow($1_t)
1408         # Relabel almost all files
1409         auth_relabel_all_files_except_shadow($1_t)
1410
1411         init_telinit($1_t)
1412
1413         logging_send_syslog_msg($1_t)
1414
1415         optional_policy(`
1416                 modutils_domtrans_insmod($1_t)
1417                 modutils_domtrans_depmod($1_t)
1418         ')
1419
1420         # The following rule is temporary until such time that a complete
1421         # policy management infrastructure is in place so that an administrator
1422         # cannot directly manipulate policy files with arbitrary programs.
1423         seutil_manage_src_policy($1_t)
1424         # Violates the goal of limiting write access to checkpolicy.
1425         # But presently necessary for installing the file_contexts file.
1426         seutil_manage_bin_policy($1_t)
1427
1428         userdom_manage_user_home_content_dirs($1_t)
1429         userdom_manage_user_home_content_files($1_t)
1430         userdom_manage_user_home_content_symlinks($1_t)
1431         userdom_manage_user_home_content_pipes($1_t)
1432         userdom_manage_user_home_content_sockets($1_t)
1433         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1434
1435         tunable_policy(`user_rw_noexattrfile',`
1436                 fs_manage_noxattr_fs_files($1_t)
1437                 fs_manage_noxattr_fs_dirs($1_t)
1438         ',`
1439                 fs_read_noxattr_fs_files($1_t)
1440         ')
1441
1442         optional_policy(`
1443                 postgresql_unconfined($1_t)
1444         ')
1445
1446         optional_policy(`
1447                 userhelper_exec($1_t)
1448         ')
1449 ')
1450
1451 ########################################
1452 ## <summary>
1453 ##      Allow user to run as a secadm
1454 ## </summary>
1455 ## <desc>
1456 ##      <p>
1457 ##      Create objects in a user home directory
1458 ##      with an automatic type transition to
1459 ##      a specified private type.
1460 ##      </p>
1461 ##      <p>
1462 ##      This is a templated interface, and should only
1463 ##      be called from a per-userdomain template.
1464 ##      </p>
1465 ## </desc>
1466 ## <param name="domain">
1467 ##      <summary>
1468 ##      Domain allowed access.
1469 ##      </summary>
1470 ## </param>
1471 ## <param name="role">
1472 ##      <summary>
1473 ##      The role  of the object to create.
1474 ##      </summary>
1475 ## </param>
1476 #
1477 template(`userdom_security_admin_template',`
1478         allow $1 self:capability { dac_read_search dac_override };
1479
1480         corecmd_exec_shell($1)
1481
1482         domain_obj_id_change_exemption($1)
1483
1484         dev_relabel_all_dev_nodes($1)
1485
1486         files_create_boot_flag($1)
1487         files_create_default_dir($1)
1488         files_root_filetrans_default($1, dir)
1489
1490         # Necessary for managing /boot/efi
1491         fs_manage_dos_files($1)
1492
1493         mls_process_read_up($1)
1494         mls_file_read_all_levels($1)
1495         mls_file_upgrade($1)
1496         mls_file_downgrade($1)
1497
1498         selinux_set_enforce_mode($1)
1499         selinux_set_all_booleans($1)
1500         selinux_set_parameters($1)
1501         selinux_read_policy($1)
1502
1503         auth_relabel_all_files_except_shadow($1)
1504         auth_relabel_shadow($1)
1505
1506         init_exec($1)
1507
1508         logging_send_syslog_msg($1)
1509         logging_read_audit_log($1)
1510         logging_read_generic_logs($1)
1511         logging_read_audit_config($1)
1512
1513         seutil_manage_bin_policy($1)
1514         seutil_manage_default_contexts($1)
1515         seutil_manage_file_contexts($1)
1516         seutil_manage_module_store($1)
1517         seutil_manage_config($1)
1518         seutil_run_checkpolicy($1,$2)
1519         seutil_run_loadpolicy($1,$2)
1520         seutil_run_semanage($1,$2)
1521         seutil_run_setsebool($1,$2)
1522         seutil_run_setfiles($1, $2)
1523
1524         optional_policy(`
1525                 aide_run($1,$2)
1526         ')
1527
1528         optional_policy(`
1529                 consoletype_exec($1)
1530         ')
1531
1532         optional_policy(`
1533                 dmesg_exec($1)
1534         ')
1535
1536         optional_policy(`
1537                 ipsec_run_setkey($1,$2)
1538         ')
1539
1540         optional_policy(`
1541                 netlabel_run_mgmt($1,$2)
1542         ')
1543
1544         optional_policy(`
1545                 samhain_run($1, $2)
1546         ')
1547 ')
1548
1549 ########################################
1550 ## <summary>
1551 ##      Make the specified type usable in a
1552 ##      user home directory.
1553 ## </summary>
1554 ## <param name="type">
1555 ##      <summary>
1556 ##      Type to be used as a file in the
1557 ##      user home directory.
1558 ##      </summary>
1559 ## </param>
1560 #
1561 interface(`userdom_user_home_content',`
1562         gen_require(`
1563                 type user_home_t;
1564                 attribute user_home_type;
1565         ')
1566
1567         allow $1 user_home_t:filesystem associate;
1568         files_type($1)
1569         ubac_constrained($1)
1570
1571         files_poly_member($1)
1572         typeattribute $1  user_home_type;
1573 ')
1574
1575 ########################################
1576 ## <summary>
1577 ##      Make the specified type usable in a
1578 ##      generic temporary directory.
1579 ## </summary>
1580 ## <param name="type">
1581 ##      <summary>
1582 ##      Type to be used as a file in the
1583 ##      generic temporary directory.
1584 ##      </summary>
1585 ## </param>
1586 #
1587 interface(`userdom_user_tmp_content',`
1588         gen_require(`
1589                 attribute user_tmp_type;
1590         ')
1591
1592         typeattribute $1 user_tmp_type;
1593
1594         files_tmp_file($1)
1595         ubac_constrained($1)
1596 ')
1597
1598 ########################################
1599 ## <summary>
1600 ##      Allow domain to attach to TUN devices created by administrative users.
1601 ## </summary>
1602 ## <param name="domain">
1603 ##      <summary>
1604 ##      Domain allowed access.
1605 ##      </summary>
1606 ## </param>
1607 #
1608 interface(`userdom_attach_admin_tun_iface',`
1609         gen_require(`
1610                 attribute admindomain;
1611         ')
1612
1613         allow $1 admindomain:tun_socket relabelfrom;
1614         allow $1 self:tun_socket relabelto;
1615 ')
1616
1617 ########################################
1618 ## <summary>
1619 ##      Set the attributes of a user pty.
1620 ## </summary>
1621 ## <param name="domain">
1622 ##      <summary>
1623 ##      Domain allowed access.
1624 ##      </summary>
1625 ## </param>
1626 #
1627 interface(`userdom_setattr_user_ptys',`
1628         gen_require(`
1629                 type user_devpts_t;
1630         ')
1631
1632         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1633 ')
1634
1635 ########################################
1636 ## <summary>
1637 ##      Create a user pty.
1638 ## </summary>
1639 ## <param name="domain">
1640 ##      <summary>
1641 ##      Domain allowed access.
1642 ##      </summary>
1643 ## </param>
1644 #
1645 interface(`userdom_create_user_pty',`
1646         gen_require(`
1647                 type user_devpts_t;
1648         ')
1649
1650         term_create_pty($1, user_devpts_t)
1651 ')
1652
1653 ########################################
1654 ## <summary>
1655 ##      Get the attributes of user home directories.
1656 ## </summary>
1657 ## <param name="domain">
1658 ##      <summary>
1659 ##      Domain allowed access.
1660 ##      </summary>
1661 ## </param>
1662 #
1663 interface(`userdom_getattr_user_home_dirs',`
1664         gen_require(`
1665                 type user_home_dir_t;
1666         ')
1667
1668         allow $1 user_home_dir_t:dir getattr_dir_perms;
1669         files_search_home($1)
1670 ')
1671
1672 ########################################
1673 ## <summary>
1674 ##      Do not audit attempts to get the attributes of user home directories.
1675 ## </summary>
1676 ## <param name="domain">
1677 ##      <summary>
1678 ##      Domain to not audit.
1679 ##      </summary>
1680 ## </param>
1681 #
1682 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1683         gen_require(`
1684                 type user_home_dir_t;
1685         ')
1686
1687         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1688 ')
1689
1690 ########################################
1691 ## <summary>
1692 ##      Search user home directories.
1693 ## </summary>
1694 ## <param name="domain">
1695 ##      <summary>
1696 ##      Domain allowed access.
1697 ##      </summary>
1698 ## </param>
1699 #
1700 interface(`userdom_search_user_home_dirs',`
1701         gen_require(`
1702                 type user_home_dir_t;
1703         ')
1704
1705         allow $1 user_home_dir_t:dir search_dir_perms;
1706         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1707         files_search_home($1)
1708 ')
1709
1710 ########################################
1711 ## <summary>
1712 ##      Do not audit attempts to search user home directories.
1713 ## </summary>
1714 ## <desc>
1715 ##      <p>
1716 ##      Do not audit attempts to search user home directories.
1717 ##      This will supress SELinux denial messages when the specified
1718 ##      domain is denied the permission to search these directories.
1719 ##      </p>
1720 ## </desc>
1721 ## <param name="domain">
1722 ##      <summary>
1723 ##      Domain to not audit.
1724 ##      </summary>
1725 ## </param>
1726 ## <infoflow type="none"/>
1727 #
1728 interface(`userdom_dontaudit_search_user_home_dirs',`
1729         gen_require(`
1730                 type user_home_dir_t;
1731         ')
1732
1733         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1734 ')
1735
1736 ########################################
1737 ## <summary>
1738 ##      List user home directories.
1739 ## </summary>
1740 ## <param name="domain">
1741 ##      <summary>
1742 ##      Domain allowed access.
1743 ##      </summary>
1744 ## </param>
1745 #
1746 interface(`userdom_list_user_home_dirs',`
1747         gen_require(`
1748                 type user_home_dir_t;
1749         ')
1750
1751         allow $1 user_home_dir_t:dir list_dir_perms;
1752         files_search_home($1)
1753
1754         tunable_policy(`use_nfs_home_dirs',`
1755                 fs_list_nfs($1)
1756         ')
1757
1758         tunable_policy(`use_samba_home_dirs',`
1759                 fs_list_cifs($1)
1760         ')
1761 ')
1762
1763 ########################################
1764 ## <summary>
1765 ##      Do not audit attempts to list user home subdirectories.
1766 ## </summary>
1767 ## <param name="domain">
1768 ##      <summary>
1769 ##      Domain to not audit.
1770 ##      </summary>
1771 ## </param>
1772 #
1773 interface(`userdom_dontaudit_list_user_home_dirs',`
1774         gen_require(`
1775                 type user_home_dir_t;
1776                 type user_home_t;
1777         ')
1778
1779         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1780         dontaudit $1 user_home_t:dir list_dir_perms;
1781 ')
1782
1783 ########################################
1784 ## <summary>
1785 ##      Create user home directories.
1786 ## </summary>
1787 ## <param name="domain">
1788 ##      <summary>
1789 ##      Domain allowed access.
1790 ##      </summary>
1791 ## </param>
1792 #
1793 interface(`userdom_create_user_home_dirs',`
1794         gen_require(`
1795                 type user_home_dir_t;
1796         ')
1797
1798         allow $1 user_home_dir_t:dir create_dir_perms;
1799 ')
1800
1801 ########################################
1802 ## <summary>
1803 ##      Create user home directories.
1804 ## </summary>
1805 ## <param name="domain">
1806 ##      <summary>
1807 ##      Domain allowed access.
1808 ##      </summary>
1809 ## </param>
1810 #
1811 interface(`userdom_manage_user_home_dirs',`
1812         gen_require(`
1813                 type user_home_dir_t;
1814         ')
1815
1816         allow $1 user_home_dir_t:dir manage_dir_perms;
1817 ')
1818
1819 ########################################
1820 ## <summary>
1821 ##      Relabel to user home directories.
1822 ## </summary>
1823 ## <param name="domain">
1824 ##      <summary>
1825 ##      Domain allowed access.
1826 ##      </summary>
1827 ## </param>
1828 #
1829 interface(`userdom_relabelto_user_home_dirs',`
1830         gen_require(`
1831                 type user_home_dir_t;
1832         ')
1833
1834         allow $1 user_home_dir_t:dir relabelto;
1835 ')
1836
1837
1838 ########################################
1839 ## <summary>
1840 ##      Relabel to user home files.
1841 ## </summary>
1842 ## <param name="domain">
1843 ##      <summary>
1844 ##      Domain allowed access.
1845 ##      </summary>
1846 ## </param>
1847 #
1848 interface(`userdom_relabelto_user_home_files',`
1849         gen_require(`
1850                 type user_home_t;
1851         ')
1852
1853         allow $1 user_home_t:file relabelto;
1854 ')
1855 ########################################
1856 ## <summary>
1857 ##      Relabel user home files.
1858 ## </summary>
1859 ## <param name="domain">
1860 ##      <summary>
1861 ##      Domain allowed access.
1862 ##      </summary>
1863 ## </param>
1864 #
1865 interface(`userdom_relabel_user_home_files',`
1866         gen_require(`
1867                 type user_home_t;
1868         ')
1869
1870         allow $1 user_home_t:file relabel_file_perms;
1871 ')
1872
1873 ########################################
1874 ## <summary>
1875 ##      Create directories in the home dir root with
1876 ##      the user home directory type.
1877 ## </summary>
1878 ## <param name="domain">
1879 ##      <summary>
1880 ##      Domain allowed access.
1881 ##      </summary>
1882 ## </param>
1883 #
1884 interface(`userdom_home_filetrans_user_home_dir',`
1885         gen_require(`
1886                 type user_home_dir_t;
1887         ')
1888
1889         files_home_filetrans($1, user_home_dir_t, dir)
1890 ')
1891
1892 ########################################
1893 ## <summary>
1894 ##      Do a domain transition to the specified
1895 ##      domain when executing a program in the
1896 ##      user home directory.
1897 ## </summary>
1898 ## <desc>
1899 ##      <p>
1900 ##      Do a domain transition to the specified
1901 ##      domain when executing a program in the
1902 ##      user home directory.
1903 ##      </p>
1904 ##      <p>
1905 ##      No interprocess communication (signals, pipes,
1906 ##      etc.) is provided by this interface since
1907 ##      the domains are not owned by this module.
1908 ##      </p>
1909 ## </desc>
1910 ## <param name="source_domain">
1911 ##      <summary>
1912 ##      Domain allowed to transition.
1913 ##      </summary>
1914 ## </param>
1915 ## <param name="target_domain">
1916 ##      <summary>
1917 ##      Domain to transition to.
1918 ##      </summary>
1919 ## </param>
1920 #
1921 interface(`userdom_user_home_domtrans',`
1922         gen_require(`
1923                 type user_home_dir_t, user_home_t;
1924         ')
1925
1926         domain_auto_trans($1, user_home_t, $2)
1927         allow $1 user_home_dir_t:dir search_dir_perms;
1928         files_search_home($1)
1929 ')
1930
1931 ########################################
1932 ## <summary>
1933 ##      Do not audit attempts to search user home content directories.
1934 ## </summary>
1935 ## <param name="domain">
1936 ##      <summary>
1937 ##      Domain to not audit.
1938 ##      </summary>
1939 ## </param>
1940 #
1941 interface(`userdom_dontaudit_search_user_home_content',`
1942         gen_require(`
1943                 type user_home_t;
1944         ')
1945
1946         dontaudit $1 user_home_t:dir search_dir_perms;
1947         fs_dontaudit_list_nfs($1)
1948         fs_dontaudit_list_cifs($1)
1949 ')
1950
1951 ########################################
1952 ## <summary>
1953 ##      List contents of users home directory.
1954 ## </summary>
1955 ## <param name="domain">
1956 ##      <summary>
1957 ##      Domain allowed access.
1958 ##      </summary>
1959 ## </param>
1960 #
1961 interface(`userdom_list_user_home_content',`
1962         gen_require(`
1963                 type user_home_dir_t;
1964                 attribute user_home_type;
1965         ')
1966
1967         files_list_home($1)
1968         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
1969 ')
1970
1971 ########################################
1972 ## <summary>
1973 ##      Create, read, write, and delete directories
1974 ##      in a user home subdirectory.
1975 ## </summary>
1976 ## <param name="domain">
1977 ##      <summary>
1978 ##      Domain allowed access.
1979 ##      </summary>
1980 ## </param>
1981 #
1982 interface(`userdom_manage_user_home_content_dirs',`
1983         gen_require(`
1984                 type user_home_dir_t, user_home_t;
1985         ')
1986
1987         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1988         files_search_home($1)
1989 ')
1990
1991 ########################################
1992 ## <summary>
1993 ##      Delete directories in a user home subdirectory.
1994 ## </summary>
1995 ## <param name="domain">
1996 ##      <summary>
1997 ##      Domain allowed access.
1998 ##      </summary>
1999 ## </param>
2000 #
2001 interface(`userdom_delete_user_home_content_dirs',`
2002         gen_require(`
2003                 type user_home_t;
2004         ')
2005
2006         allow $1 user_home_t:dir delete_dir_perms;
2007 ')
2008
2009 ########################################
2010 ## <summary>
2011 ##      Set the attributes of user home files.
2012 ## </summary>
2013 ## <param name="domain">
2014 ##      <summary>
2015 ##      Domain allowed access.
2016 ##      </summary>
2017 ## </param>
2018 ## <rolecap/>
2019 #
2020 interface(`userdom_setattr_user_home_content_files',`
2021         gen_require(`
2022                 type user_home_t;
2023         ')
2024
2025         allow $1 user_home_t:file setattr;
2026 ')
2027
2028 ########################################
2029 ## <summary>
2030 ##      Do not audit attempts to set the
2031 ##      attributes of user home files.
2032 ## </summary>
2033 ## <param name="domain">
2034 ##      <summary>
2035 ##      Domain to not audit.
2036 ##      </summary>
2037 ## </param>
2038 #
2039 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2040         gen_require(`
2041                 type user_home_t;
2042         ')
2043
2044         dontaudit $1 user_home_t:file setattr_file_perms;
2045 ')
2046
2047 ########################################
2048 ## <summary>
2049 ##      Mmap user home files.
2050 ## </summary>
2051 ## <param name="domain">
2052 ##      <summary>
2053 ##      Domain allowed access.
2054 ##      </summary>
2055 ## </param>
2056 #
2057 interface(`userdom_mmap_user_home_content_files',`
2058         gen_require(`
2059                 type user_home_dir_t, user_home_t;
2060         ')
2061
2062         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2063         files_search_home($1)
2064 ')
2065
2066 ########################################
2067 ## <summary>
2068 ##      Read user home files.
2069 ## </summary>
2070 ## <param name="domain">
2071 ##      <summary>
2072 ##      Domain allowed access.
2073 ##      </summary>
2074 ## </param>
2075 #
2076 interface(`userdom_read_user_home_content_files',`
2077         gen_require(`
2078                 type user_home_dir_t, user_home_t;
2079         ')
2080
2081         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2082         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2083         files_search_home($1)
2084 ')
2085
2086 ########################################
2087 ## <summary>
2088 ##      Do not audit attempts to getattr user home files.
2089 ## </summary>
2090 ## <param name="domain">
2091 ##      <summary>
2092 ##      Domain to not audit.
2093 ##      </summary>
2094 ## </param>
2095 #
2096 interface(`userdom_dontaudit_getattr_user_home_content',`
2097         gen_require(`
2098                 attribute user_home_type;
2099         ')
2100
2101         dontaudit $1 user_home_type:dir getattr;
2102         dontaudit $1 user_home_type:file getattr;
2103 ')
2104
2105 ########################################
2106 ## <summary>
2107 ##      Do not audit attempts to read user home files.
2108 ## </summary>
2109 ## <param name="domain">
2110 ##      <summary>
2111 ##      Domain to not audit.
2112 ##      </summary>
2113 ## </param>
2114 #
2115 interface(`userdom_dontaudit_read_user_home_content_files',`
2116         gen_require(`
2117                 attribute user_home_type;
2118                 type user_home_dir_t;
2119         ')
2120
2121         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2122         dontaudit $1 user_home_type:dir list_dir_perms;
2123         dontaudit $1 user_home_type:file read_file_perms;
2124         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2125 ')
2126
2127 ########################################
2128 ## <summary>
2129 ##      Do not audit attempts to append user home files.
2130 ## </summary>
2131 ## <param name="domain">
2132 ##      <summary>
2133 ##      Domain to not audit.
2134 ##      </summary>
2135 ## </param>
2136 #
2137 interface(`userdom_dontaudit_append_user_home_content_files',`
2138         gen_require(`
2139                 type user_home_t;
2140         ')
2141
2142         dontaudit $1 user_home_t:file append_file_perms;
2143 ')
2144
2145 ########################################
2146 ## <summary>
2147 ##      Do not audit attempts to write user home files.
2148 ## </summary>
2149 ## <param name="domain">
2150 ##      <summary>
2151 ##      Domain to not audit.
2152 ##      </summary>
2153 ## </param>
2154 #
2155 interface(`userdom_dontaudit_write_user_home_content_files',`
2156         gen_require(`
2157                 type user_home_t;
2158         ')
2159
2160         dontaudit $1 user_home_t:file write_file_perms;
2161 ')
2162
2163 ########################################
2164 ## <summary>
2165 ##      Delete files in a user home subdirectory.
2166 ## </summary>
2167 ## <param name="domain">
2168 ##      <summary>
2169 ##      Domain allowed access.
2170 ##      </summary>
2171 ## </param>
2172 #
2173 interface(`userdom_delete_user_home_content_files',`
2174         gen_require(`
2175                 type user_home_t;
2176         ')
2177
2178         allow $1 user_home_t:file delete_file_perms;
2179 ')
2180
2181 ########################################
2182 ## <summary>
2183 ##      Delete sock files in a user home subdirectory.
2184 ## </summary>
2185 ## <param name="domain">
2186 ##      <summary>
2187 ##      Domain allowed access.
2188 ##      </summary>
2189 ## </param>
2190 #
2191 interface(`userdom_delete_user_home_content_sock_files',`
2192         gen_require(`
2193                 type user_home_t;
2194         ')
2195
2196         allow $1 user_home_t:sock_file delete_file_perms;
2197 ')
2198
2199 ########################################
2200 ## <summary>
2201 ##      Do not audit attempts to write user home files.
2202 ## </summary>
2203 ## <param name="domain">
2204 ##      <summary>
2205 ##      Domain to not audit.
2206 ##      </summary>
2207 ## </param>
2208 #
2209 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2210         gen_require(`
2211                 type user_home_t;
2212         ')
2213
2214         dontaudit $1 user_home_t:file relabel_file_perms;
2215 ')
2216
2217 ########################################
2218 ## <summary>
2219 ##      Read user home subdirectory symbolic links.
2220 ## </summary>
2221 ## <param name="domain">
2222 ##      <summary>
2223 ##      Domain allowed access.
2224 ##      </summary>
2225 ## </param>
2226 #
2227 interface(`userdom_read_user_home_content_symlinks',`
2228         gen_require(`
2229                 type user_home_dir_t, user_home_t;
2230         ')
2231
2232         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2233 ')
2234
2235 ########################################
2236 ## <summary>
2237 ##      Execute user home files.
2238 ## </summary>
2239 ## <param name="domain">
2240 ##      <summary>
2241 ##      Domain allowed access.
2242 ##      </summary>
2243 ## </param>
2244 ## <rolecap/>
2245 #
2246 interface(`userdom_exec_user_home_content_files',`
2247         gen_require(`
2248                 type user_home_dir_t;
2249                 attribute user_home_type;
2250         ')
2251
2252         files_search_home($1)
2253         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2254         dontaudit $1 user_home_type:sock_file execute;
2255         ')
2256
2257 ########################################
2258 ## <summary>
2259 ##      Do not audit attempts to execute user home files.
2260 ## </summary>
2261 ## <param name="domain">
2262 ##      <summary>
2263 ##      Domain to not audit.
2264 ##      </summary>
2265 ## </param>
2266 #
2267 interface(`userdom_dontaudit_exec_user_home_content_files',`
2268         gen_require(`
2269                 type user_home_t;
2270         ')
2271
2272         dontaudit $1 user_home_t:file exec_file_perms;
2273 ')
2274
2275 ########################################
2276 ## <summary>
2277 ##      Create, read, write, and delete files
2278 ##      in a user home subdirectory.
2279 ## </summary>
2280 ## <param name="domain">
2281 ##      <summary>
2282 ##      Domain allowed access.
2283 ##      </summary>
2284 ## </param>
2285 #
2286 interface(`userdom_manage_user_home_content_files',`
2287         gen_require(`
2288                 type user_home_dir_t, user_home_t;
2289         ')
2290
2291         manage_files_pattern($1, user_home_t, user_home_t)
2292         allow $1 user_home_dir_t:dir search_dir_perms;
2293         files_search_home($1)
2294 ')
2295
2296 ########################################
2297 ## <summary>
2298 ##      Do not audit attempts to create, read, write, and delete directories
2299 ##      in a user home subdirectory.
2300 ## </summary>
2301 ## <param name="domain">
2302 ##      <summary>
2303 ##      Domain to not audit.
2304 ##      </summary>
2305 ## </param>
2306 #
2307 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2308         gen_require(`
2309                 type user_home_dir_t, user_home_t;
2310         ')
2311
2312         dontaudit $1 user_home_t:dir manage_dir_perms;
2313 ')
2314
2315 ########################################
2316 ## <summary>
2317 ##      Create, read, write, and delete symbolic links
2318 ##      in a user home subdirectory.
2319 ## </summary>
2320 ## <param name="domain">
2321 ##      <summary>
2322 ##      Domain allowed access.
2323 ##      </summary>
2324 ## </param>
2325 #
2326 interface(`userdom_manage_user_home_content_symlinks',`
2327         gen_require(`
2328                 type user_home_dir_t, user_home_t;
2329         ')
2330
2331         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2332         allow $1 user_home_dir_t:dir search_dir_perms;
2333         files_search_home($1)
2334 ')
2335
2336 ########################################
2337 ## <summary>
2338 ##      Delete symbolic links in a user home directory.
2339 ## </summary>
2340 ## <param name="domain">
2341 ##      <summary>
2342 ##      Domain allowed access.
2343 ##      </summary>
2344 ## </param>
2345 #
2346 interface(`userdom_delete_user_home_content_symlinks',`
2347         gen_require(`
2348                 type user_home_t;
2349         ')
2350
2351         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2352 ')
2353
2354 ########################################
2355 ## <summary>
2356 ##      Create, read, write, and delete named pipes
2357 ##      in a user home subdirectory.
2358 ## </summary>
2359 ## <param name="domain">
2360 ##      <summary>
2361 ##      Domain allowed access.
2362 ##      </summary>
2363 ## </param>
2364 #
2365 interface(`userdom_manage_user_home_content_pipes',`
2366         gen_require(`
2367                 type user_home_dir_t, user_home_t;
2368         ')
2369
2370         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2371         allow $1 user_home_dir_t:dir search_dir_perms;
2372         files_search_home($1)
2373 ')
2374
2375 ########################################
2376 ## <summary>
2377 ##      Create, read, write, and delete named sockets
2378 ##      in a user home subdirectory.
2379 ## </summary>
2380 ## <param name="domain">
2381 ##      <summary>
2382 ##      Domain allowed access.
2383 ##      </summary>
2384 ## </param>
2385 #
2386 interface(`userdom_manage_user_home_content_sockets',`
2387         gen_require(`
2388                 type user_home_dir_t, user_home_t;
2389         ')
2390
2391         allow $1 user_home_dir_t:dir search_dir_perms;
2392         manage_sock_files_pattern($1, user_home_t, user_home_t)
2393         files_search_home($1)
2394 ')
2395
2396 ########################################
2397 ## <summary>
2398 ##      Create objects in a user home directory
2399 ##      with an automatic type transition to
2400 ##      a specified private type.
2401 ## </summary>
2402 ## <param name="domain">
2403 ##      <summary>
2404 ##      Domain allowed access.
2405 ##      </summary>
2406 ## </param>
2407 ## <param name="private_type">
2408 ##      <summary>
2409 ##      The type of the object to create.
2410 ##      </summary>
2411 ## </param>
2412 ## <param name="object_class">
2413 ##      <summary>
2414 ##      The class of the object to be created.
2415 ##      </summary>
2416 ## </param>
2417 #
2418 interface(`userdom_user_home_dir_filetrans',`
2419         gen_require(`
2420                 type user_home_dir_t;
2421         ')
2422
2423         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2424         files_search_home($1)
2425 ')
2426
2427 ########################################
2428 ## <summary>
2429 ##      Create objects in a user home directory
2430 ##      with an automatic type transition to
2431 ##      a specified private type.
2432 ## </summary>
2433 ## <param name="domain">
2434 ##      <summary>
2435 ##      Domain allowed access.
2436 ##      </summary>
2437 ## </param>
2438 ## <param name="private_type">
2439 ##      <summary>
2440 ##      The type of the object to create.
2441 ##      </summary>
2442 ## </param>
2443 ## <param name="object_class">
2444 ##      <summary>
2445 ##      The class of the object to be created.
2446 ##      </summary>
2447 ## </param>
2448 #
2449 interface(`userdom_user_home_content_filetrans',`
2450         gen_require(`
2451                 type user_home_dir_t, user_home_t;
2452         ')
2453
2454         filetrans_pattern($1, user_home_t, $2, $3)
2455         allow $1 user_home_dir_t:dir search_dir_perms;
2456         files_search_home($1)
2457 ')
2458
2459 ########################################
2460 ## <summary>
2461 ##      Create objects in a user home directory
2462 ##      with an automatic type transition to
2463 ##      the user home file type.
2464 ## </summary>
2465 ## <param name="domain">
2466 ##      <summary>
2467 ##      Domain allowed access.
2468 ##      </summary>
2469 ## </param>
2470 ## <param name="object_class">
2471 ##      <summary>
2472 ##      The class of the object to be created.
2473 ##      </summary>
2474 ## </param>
2475 #
2476 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2477         gen_require(`
2478                 type user_home_dir_t, user_home_t;
2479         ')
2480
2481         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2482         files_search_home($1)
2483 ')
2484
2485 ########################################
2486 ## <summary>
2487 ##      Write to user temporary named sockets.
2488 ## </summary>
2489 ## <param name="domain">
2490 ##      <summary>
2491 ##      Domain allowed access.
2492 ##      </summary>
2493 ## </param>
2494 #
2495 interface(`userdom_write_user_tmp_sockets',`
2496         gen_require(`
2497                 type user_tmp_t;
2498         ')
2499
2500         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2501         files_search_tmp($1)
2502 ')
2503
2504 ########################################
2505 ## <summary>
2506 ##      List user temporary directories.
2507 ## </summary>
2508 ## <param name="domain">
2509 ##      <summary>
2510 ##      Domain allowed access.
2511 ##      </summary>
2512 ## </param>
2513 #
2514 interface(`userdom_list_user_tmp',`
2515         gen_require(`
2516                 type user_tmp_t;
2517         ')
2518
2519         allow $1 user_tmp_t:dir list_dir_perms;
2520         files_search_tmp($1)
2521 ')
2522
2523 ########################################
2524 ## <summary>
2525 ##      Do not audit attempts to list user
2526 ##      temporary directories.
2527 ## </summary>
2528 ## <param name="domain">
2529 ##      <summary>
2530 ##      Domain to not audit.
2531 ##      </summary>
2532 ## </param>
2533 #
2534 interface(`userdom_dontaudit_list_user_tmp',`
2535         gen_require(`
2536                 type user_tmp_t;
2537         ')
2538
2539         dontaudit $1 user_tmp_t:dir list_dir_perms;
2540 ')
2541
2542 ########################################
2543 ## <summary>
2544 ##      Do not audit attempts to manage users
2545 ##      temporary directories.
2546 ## </summary>
2547 ## <param name="domain">
2548 ##      <summary>
2549 ##      Domain to not audit.
2550 ##      </summary>
2551 ## </param>
2552 #
2553 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2554         gen_require(`
2555                 type user_tmp_t;
2556         ')
2557
2558         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2559 ')
2560
2561 ########################################
2562 ## <summary>
2563 ##      Read user temporary files.
2564 ## </summary>
2565 ## <param name="domain">
2566 ##      <summary>
2567 ##      Domain allowed access.
2568 ##      </summary>
2569 ## </param>
2570 #
2571 interface(`userdom_read_user_tmp_files',`
2572         gen_require(`
2573                 type user_tmp_t;
2574         ')
2575
2576         read_files_pattern($1, user_tmp_t, user_tmp_t)
2577         allow $1 user_tmp_t:dir list_dir_perms;
2578         files_search_tmp($1)
2579 ')
2580
2581 ########################################
2582 ## <summary>
2583 ##      Do not audit attempts to read users
2584 ##      temporary files.
2585 ## </summary>
2586 ## <param name="domain">
2587 ##      <summary>
2588 ##      Domain to not audit.
2589 ##      </summary>
2590 ## </param>
2591 #
2592 interface(`userdom_dontaudit_read_user_tmp_files',`
2593         gen_require(`
2594                 type user_tmp_t;
2595         ')
2596
2597         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2598 ')
2599
2600 ########################################
2601 ## <summary>
2602 ##      Do not audit attempts to append users
2603 ##      temporary files.
2604 ## </summary>
2605 ## <param name="domain">
2606 ##      <summary>
2607 ##      Domain to not audit.
2608 ##      </summary>
2609 ## </param>
2610 #
2611 interface(`userdom_dontaudit_append_user_tmp_files',`
2612         gen_require(`
2613                 type user_tmp_t;
2614         ')
2615
2616         dontaudit $1 user_tmp_t:file append_file_perms;
2617 ')
2618
2619 ########################################
2620 ## <summary>
2621 ##      Read and write user temporary files.
2622 ## </summary>
2623 ## <param name="domain">
2624 ##      <summary>
2625 ##      Domain allowed access.
2626 ##      </summary>
2627 ## </param>
2628 #
2629 interface(`userdom_rw_user_tmp_files',`
2630         gen_require(`
2631                 type user_tmp_t;
2632         ')
2633
2634         allow $1 user_tmp_t:dir list_dir_perms;
2635         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2636         files_search_tmp($1)
2637 ')
2638
2639 ########################################
2640 ## <summary>
2641 ##      Do not audit attempts to manage users
2642 ##      temporary files.
2643 ## </summary>
2644 ## <param name="domain">
2645 ##      <summary>
2646 ##      Domain to not audit.
2647 ##      </summary>
2648 ## </param>
2649 #
2650 interface(`userdom_dontaudit_manage_user_tmp_files',`
2651         gen_require(`
2652                 type user_tmp_t;
2653         ')
2654
2655         dontaudit $1 user_tmp_t:file manage_file_perms;
2656 ')
2657
2658 ########################################
2659 ## <summary>
2660 ##      Read user temporary symbolic links.
2661 ## </summary>
2662 ## <param name="domain">
2663 ##      <summary>
2664 ##      Domain allowed access.
2665 ##      </summary>
2666 ## </param>
2667 #
2668 interface(`userdom_read_user_tmp_symlinks',`
2669         gen_require(`
2670                 type user_tmp_t;
2671         ')
2672
2673         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2674         allow $1 user_tmp_t:dir list_dir_perms;
2675         files_search_tmp($1)
2676 ')
2677
2678 ########################################
2679 ## <summary>
2680 ##      Create, read, write, and delete user
2681 ##      temporary directories.
2682 ## </summary>
2683 ## <param name="domain">
2684 ##      <summary>
2685 ##      Domain allowed access.
2686 ##      </summary>
2687 ## </param>
2688 #
2689 interface(`userdom_manage_user_tmp_dirs',`
2690         gen_require(`
2691                 type user_tmp_t;
2692         ')
2693
2694         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2695         files_search_tmp($1)
2696 ')
2697
2698 ########################################
2699 ## <summary>
2700 ##      Create, read, write, and delete user
2701 ##      temporary files.
2702 ## </summary>
2703 ## <param name="domain">
2704 ##      <summary>
2705 ##      Domain allowed access.
2706 ##      </summary>
2707 ## </param>
2708 #
2709 interface(`userdom_manage_user_tmp_files',`
2710         gen_require(`
2711                 type user_tmp_t;
2712         ')
2713
2714         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2715         files_search_tmp($1)
2716 ')
2717
2718 ########################################
2719 ## <summary>
2720 ##      Create, read, write, and delete user
2721 ##      temporary symbolic links.
2722 ## </summary>
2723 ## <param name="domain">
2724 ##      <summary>
2725 ##      Domain allowed access.
2726 ##      </summary>
2727 ## </param>
2728 #
2729 interface(`userdom_manage_user_tmp_symlinks',`
2730         gen_require(`
2731                 type user_tmp_t;
2732         ')
2733
2734         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2735         files_search_tmp($1)
2736 ')
2737
2738 ########################################
2739 ## <summary>
2740 ##      Create, read, write, and delete user
2741 ##      temporary named pipes.
2742 ## </summary>
2743 ## <param name="domain">
2744 ##      <summary>
2745 ##      Domain allowed access.
2746 ##      </summary>
2747 ## </param>
2748 #
2749 interface(`userdom_manage_user_tmp_pipes',`
2750         gen_require(`
2751                 type user_tmp_t;
2752         ')
2753
2754         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2755         files_search_tmp($1)
2756 ')
2757
2758 ########################################
2759 ## <summary>
2760 ##      Create, read, write, and delete user
2761 ##      temporary named sockets.
2762 ## </summary>
2763 ## <param name="domain">
2764 ##      <summary>
2765 ##      Domain allowed access.
2766 ##      </summary>
2767 ## </param>
2768 #
2769 interface(`userdom_manage_user_tmp_sockets',`
2770         gen_require(`
2771                 type user_tmp_t;
2772         ')
2773
2774         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2775         files_search_tmp($1)
2776 ')
2777
2778 ########################################
2779 ## <summary>
2780 ##      Create objects in a user temporary directory
2781 ##      with an automatic type transition to
2782 ##      a specified private type.
2783 ## </summary>
2784 ## <param name="domain">
2785 ##      <summary>
2786 ##      Domain allowed access.
2787 ##      </summary>
2788 ## </param>
2789 ## <param name="private_type">
2790 ##      <summary>
2791 ##      The type of the object to create.
2792 ##      </summary>
2793 ## </param>
2794 ## <param name="object_class">
2795 ##      <summary>
2796 ##      The class of the object to be created.
2797 ##      </summary>
2798 ## </param>
2799 #
2800 interface(`userdom_user_tmp_filetrans',`
2801         gen_require(`
2802                 type user_tmp_t;
2803         ')
2804
2805         filetrans_pattern($1, user_tmp_t, $2, $3)
2806         files_search_tmp($1)
2807 ')
2808
2809 ########################################
2810 ## <summary>
2811 ##      Create objects in the temporary directory
2812 ##      with an automatic type transition to
2813 ##      the user temporary type.
2814 ## </summary>
2815 ## <param name="domain">
2816 ##      <summary>
2817 ##      Domain allowed access.
2818 ##      </summary>
2819 ## </param>
2820 ## <param name="object_class">
2821 ##      <summary>
2822 ##      The class of the object to be created.
2823 ##      </summary>
2824 ## </param>
2825 #
2826 interface(`userdom_tmp_filetrans_user_tmp',`
2827         gen_require(`
2828                 type user_tmp_t;
2829         ')
2830
2831         files_tmp_filetrans($1, user_tmp_t, $2)
2832 ')
2833
2834 ########################################
2835 ## <summary>
2836 ##      Read user tmpfs files.
2837 ## </summary>
2838 ## <param name="domain">
2839 ##      <summary>
2840 ##      Domain allowed access.
2841 ##      </summary>
2842 ## </param>
2843 #
2844 interface(`userdom_read_user_tmpfs_files',`
2845         gen_require(`
2846                 type user_tmpfs_t;
2847         ')
2848
2849         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2850         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2851         allow $1 user_tmpfs_t:dir list_dir_perms;
2852         fs_search_tmpfs($1)
2853 ')
2854
2855 ########################################
2856 ## <summary>
2857 ##      Read/Write user tmpfs files.
2858 ## </summary>
2859 ## <param name="domain">
2860 ##      <summary>
2861 ##      Domain allowed access.
2862 ##      </summary>
2863 ## </param>
2864 #
2865 interface(`userdom_rw_user_tmpfs_files',`
2866         gen_require(`
2867                 type user_tmpfs_t;
2868         ')
2869
2870         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2871         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2872         allow $1 user_tmpfs_t:dir list_dir_perms;
2873         fs_search_tmpfs($1)
2874 ')
2875
2876 ########################################
2877 ## <summary>
2878 ##      Get the attributes of a user domain tty.
2879 ## </summary>
2880 ## <param name="domain">
2881 ##      <summary>
2882 ##      Domain allowed access.
2883 ##      </summary>
2884 ## </param>
2885 #
2886 interface(`userdom_getattr_user_ttys',`
2887         gen_require(`
2888                 type user_tty_device_t;
2889         ')
2890
2891         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2892 ')
2893
2894 ########################################
2895 ## <summary>
2896 ##      Do not audit attempts to get the attributes of a user domain tty.
2897 ## </summary>
2898 ## <param name="domain">
2899 ##      <summary>
2900 ##      Domain to not audit.
2901 ##      </summary>
2902 ## </param>
2903 #
2904 interface(`userdom_dontaudit_getattr_user_ttys',`
2905         gen_require(`
2906                 type user_tty_device_t;
2907         ')
2908
2909         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2910 ')
2911
2912 ########################################
2913 ## <summary>
2914 ##      Set the attributes of a user domain tty.
2915 ## </summary>
2916 ## <param name="domain">
2917 ##      <summary>
2918 ##      Domain allowed access.
2919 ##      </summary>
2920 ## </param>
2921 #
2922 interface(`userdom_setattr_user_ttys',`
2923         gen_require(`
2924                 type user_tty_device_t;
2925         ')
2926
2927         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2928 ')
2929
2930 ########################################
2931 ## <summary>
2932 ##      Do not audit attempts to set the attributes of a user domain tty.
2933 ## </summary>
2934 ## <param name="domain">
2935 ##      <summary>
2936 ##      Domain to not audit.
2937 ##      </summary>
2938 ## </param>
2939 #
2940 interface(`userdom_dontaudit_setattr_user_ttys',`
2941         gen_require(`
2942                 type user_tty_device_t;
2943         ')
2944
2945         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2946 ')
2947
2948 ########################################
2949 ## <summary>
2950 ##      Read and write a user domain tty.
2951 ## </summary>
2952 ## <param name="domain">
2953 ##      <summary>
2954 ##      Domain allowed access.
2955 ##      </summary>
2956 ## </param>
2957 #
2958 interface(`userdom_use_user_ttys',`
2959         gen_require(`
2960                 type user_tty_device_t;
2961         ')
2962
2963         allow $1 user_tty_device_t:chr_file rw_term_perms;
2964 ')
2965
2966 ########################################
2967 ## <summary>
2968 ##      Read and write a inherited user domain tty.
2969 ## </summary>
2970 ## <param name="domain">
2971 ##      <summary>
2972 ##      Domain allowed access.
2973 ##      </summary>
2974 ## </param>
2975 #
2976 interface(`userdom_use_inherited_user_ttys',`
2977         gen_require(`
2978                 type user_tty_device_t;
2979         ')
2980
2981         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
2982 ')
2983
2984 ########################################
2985 ## <summary>
2986 ##      Read and write a user domain pty.
2987 ## </summary>
2988 ## <param name="domain">
2989 ##      <summary>
2990 ##      Domain allowed access.
2991 ##      </summary>
2992 ## </param>
2993 #
2994 interface(`userdom_use_user_ptys',`
2995         gen_require(`
2996                 type user_devpts_t;
2997         ')
2998
2999         allow $1 user_devpts_t:chr_file rw_term_perms;
3000 ')
3001
3002 ########################################
3003 ## <summary>
3004 ##      Read and write a inherited user domain pty.
3005 ## </summary>
3006 ## <param name="domain">
3007 ##      <summary>
3008 ##      Domain allowed access.
3009 ##      </summary>
3010 ## </param>
3011 #
3012 interface(`userdom_use_inherited_user_ptys',`
3013         gen_require(`
3014                 type user_devpts_t;
3015         ')
3016
3017         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3018 ')
3019
3020 ########################################
3021 ## <summary>
3022 ##      Read and write a inherited user TTYs and PTYs.
3023 ## </summary>
3024 ## <desc>
3025 ##      <p>
3026 ##      Allow the specified domain to read and write inherited user
3027 ##      TTYs and PTYs. This will allow the domain to
3028 ##      interact with the user via the terminal. Typically
3029 ##      all interactive applications will require this
3030 ##      access.
3031 ##      </p>
3032 ## </desc>
3033 ## <param name="domain">
3034 ##      <summary>
3035 ##      Domain allowed access.
3036 ##      </summary>
3037 ## </param>
3038 ## <infoflow type="both" weight="10"/>
3039 #
3040 interface(`userdom_use_inherited_user_terminals',`
3041         gen_require(`
3042                 type user_tty_device_t, user_devpts_t;
3043         ')
3044
3045         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3046         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3047 ')
3048
3049 #######################################
3050 ## <summary>
3051 ##  Allow attempts to read and write
3052 ##  a user domain tty and pty.
3053 ## </summary>
3054 ## <param name="domain">
3055 ##  <summary>
3056 ##  Domain to not audit.
3057 ##  </summary>
3058 ## </param>
3059 #
3060 interface(`userdom_use_user_terminals',`
3061     gen_require(`
3062         type user_tty_device_t, user_devpts_t;
3063     ')
3064
3065     allow $1 user_tty_device_t:chr_file rw_term_perms;
3066     allow $1 user_devpts_t:chr_file rw_term_perms;
3067 ')
3068
3069 ########################################
3070 ## <summary>
3071 ##      Do not audit attempts to read and write
3072 ##      a user domain tty and pty.
3073 ## </summary>
3074 ## <param name="domain">
3075 ##      <summary>
3076 ##      Domain to not audit.
3077 ##      </summary>
3078 ## </param>
3079 #
3080 interface(`userdom_dontaudit_use_user_terminals',`
3081         gen_require(`
3082                 type user_tty_device_t, user_devpts_t;
3083         ')
3084
3085         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3086         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3087 ')
3088
3089 ########################################
3090 ## <summary>
3091 ##      Execute a shell in all user domains.  This
3092 ##      is an explicit transition, requiring the
3093 ##      caller to use setexeccon().
3094 ## </summary>
3095 ## <param name="domain">
3096 ##      <summary>
3097 ##      Domain allowed to transition.
3098 ##      </summary>
3099 ## </param>
3100 #
3101 interface(`userdom_spec_domtrans_all_users',`
3102         gen_require(`
3103                 attribute userdomain;
3104         ')
3105
3106         corecmd_shell_spec_domtrans($1, userdomain)
3107         allow userdomain $1:fd use;
3108         allow userdomain $1:fifo_file rw_file_perms;
3109         allow userdomain $1:process sigchld;
3110 ')
3111
3112 ########################################
3113 ## <summary>
3114 ##      Execute an Xserver session in all unprivileged user domains.  This
3115 ##      is an explicit transition, requiring the
3116 ##      caller to use setexeccon().
3117 ## </summary>
3118 ## <param name="domain">
3119 ##      <summary>
3120 ##      Domain allowed to transition.
3121 ##      </summary>
3122 ## </param>
3123 #
3124 interface(`userdom_xsession_spec_domtrans_all_users',`
3125         gen_require(`
3126                 attribute userdomain;
3127         ')
3128
3129         xserver_xsession_spec_domtrans($1, userdomain)
3130         allow userdomain $1:fd use;
3131         allow userdomain $1:fifo_file rw_file_perms;
3132         allow userdomain $1:process sigchld;
3133 ')
3134
3135 ########################################
3136 ## <summary>
3137 ##      Execute a shell in all unprivileged user domains.  This
3138 ##      is an explicit transition, requiring the
3139 ##      caller to use setexeccon().
3140 ## </summary>
3141 ## <param name="domain">
3142 ##      <summary>
3143 ##      Domain allowed to transition.
3144 ##      </summary>
3145 ## </param>
3146 #
3147 interface(`userdom_spec_domtrans_unpriv_users',`
3148         gen_require(`
3149                 attribute unpriv_userdomain;
3150         ')
3151
3152         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3153         allow unpriv_userdomain $1:fd use;
3154         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3155         allow unpriv_userdomain $1:process sigchld;
3156 ')
3157
3158 ########################################
3159 ## <summary>
3160 ##      Execute an Xserver session in all unprivileged user domains.  This
3161 ##      is an explicit transition, requiring the
3162 ##      caller to use setexeccon().
3163 ## </summary>
3164 ## <param name="domain">
3165 ##      <summary>
3166 ##      Domain allowed to transition.
3167 ##      </summary>
3168 ## </param>
3169 #
3170 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3171         gen_require(`
3172                 attribute unpriv_userdomain;
3173         ')
3174
3175         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3176         allow unpriv_userdomain $1:fd use;
3177         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3178         allow unpriv_userdomain $1:process sigchld;
3179 ')
3180
3181 ########################################
3182 ## <summary>
3183 ##      Manage unpriviledged user SysV sempaphores.
3184 ## </summary>
3185 ## <param name="domain">
3186 ##      <summary>
3187 ##      Domain allowed access.
3188 ##      </summary>
3189 ## </param>
3190 #
3191 interface(`userdom_manage_unpriv_user_semaphores',`
3192         gen_require(`
3193                 attribute unpriv_userdomain;
3194         ')
3195
3196         allow $1 unpriv_userdomain:sem create_sem_perms;
3197 ')
3198
3199 ########################################
3200 ## <summary>
3201 ##      Manage unpriviledged user SysV shared
3202 ##      memory segments.
3203 ## </summary>
3204 ## <param name="domain">
3205 ##      <summary>
3206 ##      Domain allowed access.
3207 ##      </summary>
3208 ## </param>
3209 #
3210 interface(`userdom_manage_unpriv_user_shared_mem',`
3211         gen_require(`
3212                 attribute unpriv_userdomain;
3213         ')
3214
3215         allow $1 unpriv_userdomain:shm create_shm_perms;
3216 ')
3217
3218 ########################################
3219 ## <summary>
3220 ##      Execute bin_t in the unprivileged user domains. This
3221 ##      is an explicit transition, requiring the
3222 ##      caller to use setexeccon().
3223 ## </summary>
3224 ## <param name="domain">
3225 ##      <summary>
3226 ##      Domain allowed to transition.
3227 ##      </summary>
3228 ## </param>
3229 #
3230 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3231         gen_require(`
3232                 attribute unpriv_userdomain;
3233         ')
3234
3235         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3236         allow unpriv_userdomain $1:fd use;
3237         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3238         allow unpriv_userdomain $1:process sigchld;
3239 ')
3240
3241 ########################################
3242 ## <summary>
3243 ##      Execute all entrypoint files in unprivileged user
3244 ##      domains. This is an explicit transition, requiring the
3245 ##      caller to use setexeccon().
3246 ## </summary>
3247 ## <param name="domain">
3248 ##      <summary>
3249 ##      Domain allowed access.
3250 ##      </summary>
3251 ## </param>
3252 #
3253 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3254         gen_require(`
3255                 attribute unpriv_userdomain;
3256         ')
3257
3258         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3259         allow unpriv_userdomain $1:fd use;
3260         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3261         allow unpriv_userdomain $1:process sigchld;
3262 ')
3263
3264 ########################################
3265 ## <summary>
3266 ##      Search users home directories.
3267 ## </summary>
3268 ## <param name="domain">
3269 ##      <summary>
3270 ##      Domain allowed access.
3271 ##      </summary>
3272 ## </param>
3273 #
3274 interface(`userdom_search_user_home_content',`
3275         gen_require(`
3276                 type user_home_dir_t;
3277                 attribute user_home_type;
3278         ')
3279
3280         files_list_home($1)
3281         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3282         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3283 ')
3284
3285 ########################################
3286 ## <summary>
3287 ##      Send general signals to unprivileged user domains.
3288 ## </summary>
3289 ## <param name="domain">
3290 ##      <summary>
3291 ##      Domain allowed access.
3292 ##      </summary>
3293 ## </param>
3294 #
3295 interface(`userdom_signal_unpriv_users',`
3296         gen_require(`
3297                 attribute unpriv_userdomain;
3298         ')
3299
3300         allow $1 unpriv_userdomain:process signal;
3301 ')
3302
3303 ########################################
3304 ## <summary>
3305 ##      Inherit the file descriptors from unprivileged user domains.
3306 ## </summary>
3307 ## <param name="domain">
3308 ##      <summary>
3309 ##      Domain allowed access.
3310 ##      </summary>
3311 ## </param>
3312 #
3313 interface(`userdom_use_unpriv_users_fds',`
3314         gen_require(`
3315                 attribute unpriv_userdomain;
3316         ')
3317
3318         allow $1 unpriv_userdomain:fd use;
3319 ')
3320
3321 ########################################
3322 ## <summary>
3323 ##      Do not audit attempts to inherit the file descriptors
3324 ##      from unprivileged user domains.
3325 ## </summary>
3326 ## <desc>
3327 ##      <p>
3328 ##      Do not audit attempts to inherit the file descriptors
3329 ##      from unprivileged user domains. This will supress
3330 ##      SELinux denial messages when the specified domain is denied
3331 ##      the permission to inherit these file descriptors.
3332 ##      </p>
3333 ## </desc>
3334 ## <param name="domain">
3335 ##      <summary>
3336 ##      Domain to not audit.
3337 ##      </summary>
3338 ## </param>
3339 ## <infoflow type="none"/>
3340 #
3341 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3342         gen_require(`
3343                 attribute unpriv_userdomain;
3344         ')
3345
3346         dontaudit $1 unpriv_userdomain:fd use;
3347 ')
3348
3349 ########################################
3350 ## <summary>
3351 ##      Do not audit attempts to use user ptys.
3352 ## </summary>
3353 ## <param name="domain">
3354 ##      <summary>
3355 ##      Domain to not audit.
3356 ##      </summary>
3357 ## </param>
3358 #
3359 interface(`userdom_dontaudit_use_user_ptys',`
3360         gen_require(`
3361                 type user_devpts_t;
3362         ')
3363
3364         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3365 ')
3366
3367 ########################################
3368 ## <summary>
3369 ##      Relabel files to unprivileged user pty types.
3370 ## </summary>
3371 ## <param name="domain">
3372 ##      <summary>
3373 ##      Domain allowed access.
3374 ##      </summary>
3375 ## </param>
3376 #
3377 interface(`userdom_relabelto_user_ptys',`
3378         gen_require(`
3379                 type user_devpts_t;
3380         ')
3381
3382         allow $1 user_devpts_t:chr_file relabelto;
3383 ')
3384
3385 ########################################
3386 ## <summary>
3387 ##      Do not audit attempts to relabel files from
3388 ##      user pty types.
3389 ## </summary>
3390 ## <param name="domain">
3391 ##      <summary>
3392 ##      Domain to not audit.
3393 ##      </summary>
3394 ## </param>
3395 #
3396 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3397         gen_require(`
3398                 type user_devpts_t;
3399         ')
3400
3401         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3402 ')
3403
3404 ########################################
3405 ## <summary>
3406 ##      Write all users files in /tmp
3407 ## </summary>
3408 ## <param name="domain">
3409 ##      <summary>
3410 ##      Domain allowed access.
3411 ##      </summary>
3412 ## </param>
3413 #
3414 interface(`userdom_write_user_tmp_files',`
3415         gen_require(`
3416                 type user_tmp_t;
3417         ')
3418
3419         write_files_pattern($1, user_tmp_t, user_tmp_t)
3420 ')
3421
3422 ########################################
3423 ## <summary>
3424 ##      Do not audit attempts to write users
3425 ##      temporary files.
3426 ## </summary>
3427 ## <param name="domain">
3428 ##      <summary>
3429 ##      Domain to not audit.
3430 ##      </summary>
3431 ## </param>
3432 #
3433 interface(`userdom_dontaudit_write_user_tmp_files',`
3434         gen_require(`
3435                 type user_tmp_t;
3436         ')
3437
3438         dontaudit $1 user_tmp_t:file write;
3439 ')
3440
3441 ########################################
3442 ## <summary>
3443 ##      Do not audit attempts to read/write users
3444 ##      temporary fifo files.
3445 ## </summary>
3446 ## <param name="domain">
3447 ##      <summary>
3448 ##      Domain to not audit.
3449 ##      </summary>
3450 ## </param>
3451 #
3452 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3453         gen_require(`
3454                 type user_tmp_t;
3455         ')
3456
3457         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3458 ')
3459
3460 ########################################
3461 ## <summary>
3462 ##      Do not audit attempts to use user ttys.
3463 ## </summary>
3464 ## <param name="domain">
3465 ##      <summary>
3466 ##      Domain to not audit.
3467 ##      </summary>
3468 ## </param>
3469 #
3470 interface(`userdom_dontaudit_use_user_ttys',`
3471         gen_require(`
3472                 type user_tty_device_t;
3473         ')
3474
3475         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3476 ')
3477
3478 ########################################
3479 ## <summary>
3480 ##      Read the process state of all user domains.
3481 ## </summary>
3482 ## <param name="domain">
3483 ##      <summary>
3484 ##      Domain allowed access.
3485 ##      </summary>
3486 ## </param>
3487 #
3488 interface(`userdom_read_all_users_state',`
3489         gen_require(`
3490                 attribute userdomain;
3491         ')
3492
3493         read_files_pattern($1, userdomain, userdomain)
3494         read_lnk_files_pattern($1,userdomain,userdomain)
3495         kernel_search_proc($1)
3496 ')
3497
3498 ########################################
3499 ## <summary>
3500 ##      Get the attributes of all user domains.
3501 ## </summary>
3502 ## <param name="domain">
3503 ##      <summary>
3504 ##      Domain allowed access.
3505 ##      </summary>
3506 ## </param>
3507 #
3508 interface(`userdom_getattr_all_users',`
3509         gen_require(`
3510                 attribute userdomain;
3511         ')
3512
3513         allow $1 userdomain:process getattr;
3514 ')
3515
3516 ########################################
3517 ## <summary>
3518 ##      Inherit the file descriptors from all user domains
3519 ## </summary>
3520 ## <param name="domain">
3521 ##      <summary>
3522 ##      Domain allowed access.
3523 ##      </summary>
3524 ## </param>
3525 #
3526 interface(`userdom_use_all_users_fds',`
3527         gen_require(`
3528                 attribute userdomain;
3529         ')
3530
3531         allow $1 userdomain:fd use;
3532 ')
3533
3534 ########################################
3535 ## <summary>
3536 ##      Do not audit attempts to inherit the file
3537 ##      descriptors from any user domains.
3538 ## </summary>
3539 ## <param name="domain">
3540 ##      <summary>
3541 ##      Domain to not audit.
3542 ##      </summary>
3543 ## </param>
3544 #
3545 interface(`userdom_dontaudit_use_all_users_fds',`
3546         gen_require(`
3547                 attribute userdomain;
3548         ')
3549
3550         dontaudit $1 userdomain:fd use;
3551 ')
3552
3553 ########################################
3554 ## <summary>
3555 ##      Send general signals to all user domains.
3556 ## </summary>
3557 ## <param name="domain">
3558 ##      <summary>
3559 ##      Domain allowed access.
3560 ##      </summary>
3561 ## </param>
3562 #
3563 interface(`userdom_signal_all_users',`
3564         gen_require(`
3565                 attribute userdomain;
3566         ')
3567
3568         allow $1 userdomain:process signal;
3569 ')
3570
3571 ########################################
3572 ## <summary>
3573 ##      Send kill signals to all user domains.
3574 ## </summary>
3575 ## <param name="domain">
3576 ##      <summary>
3577 ##      Domain allowed access.
3578 ##      </summary>
3579 ## </param>
3580 #
3581 interface(`userdom_kill_all_users',`
3582         gen_require(`
3583                 attribute userdomain;
3584         ')
3585
3586         allow $1 userdomain:process sigkill;
3587 ')
3588
3589 ########################################
3590 ## <summary>
3591 ##      Send a SIGCHLD signal to all user domains.
3592 ## </summary>
3593 ## <param name="domain">
3594 ##      <summary>
3595 ##      Domain allowed access.
3596 ##      </summary>
3597 ## </param>
3598 #
3599 interface(`userdom_sigchld_all_users',`
3600         gen_require(`
3601                 attribute userdomain;
3602         ')
3603
3604         allow $1 userdomain:process sigchld;
3605 ')
3606
3607 ########################################
3608 ## <summary>
3609 ##      Create keys for all user domains.
3610 ## </summary>
3611 ## <param name="domain">
3612 ##      <summary>
3613 ##      Domain allowed access.
3614 ##      </summary>
3615 ## </param>
3616 #
3617 interface(`userdom_create_all_users_keys',`
3618         gen_require(`
3619                 attribute userdomain;
3620         ')
3621
3622         allow $1 userdomain:key create;
3623 ')
3624
3625 ########################################
3626 ## <summary>
3627 ##      Send a dbus message to all user domains.
3628 ## </summary>
3629 ## <param name="domain">
3630 ##      <summary>
3631 ##      Domain allowed access.
3632 ##      </summary>
3633 ## </param>
3634 #
3635 interface(`userdom_dbus_send_all_users',`
3636         gen_require(`
3637                 attribute userdomain;
3638                 class dbus send_msg;
3639         ')
3640
3641         allow $1 userdomain:dbus send_msg;
3642 ')
3643
3644 ########################################
3645 ## <summary>
3646 ##      Allow apps to set rlimits on userdomain
3647 ## </summary>
3648 ## <param name="domain">
3649 ##      <summary>
3650 ##      Domain allowed access.
3651 ##      </summary>
3652 ## </param>
3653 #
3654 interface(`userdom_set_rlimitnh',`
3655         gen_require(`
3656                 attribute userdomain;
3657         ')
3658
3659         allow $1 userdomain:process rlimitinh;
3660 ')
3661
3662 ########################################
3663 ## <summary>
3664 ##      Define this type as a Allow apps to set rlimits on userdomain
3665 ## </summary>
3666 ## <param name="domain">
3667 ##      <summary>
3668 ##      Domain allowed access.
3669 ##      </summary>
3670 ## </param>
3671 ## <param name="userdomain_prefix">
3672 ##      <summary>
3673 ##      The prefix of the user domain (e.g., user
3674 ##      is the prefix for user_t).
3675 ## </summary>
3676 ## </param>
3677 ## <param name="domain">
3678 ##      <summary>
3679 ##      Domain allowed access.
3680 ##      </summary>
3681 ## </param>
3682 #
3683 template(`userdom_unpriv_usertype',`
3684         gen_require(`
3685                 attribute unpriv_userdomain, userdomain;
3686                 attribute $1_usertype;
3687         ')
3688         typeattribute $2  $1_usertype;
3689         typeattribute $2  unpriv_userdomain;
3690         typeattribute $2  userdomain;
3691
3692         ubac_constrained($2)
3693 ')
3694
3695 ########################################
3696 ## <summary>
3697 ##      Connect to users over an unix stream socket.
3698 ## </summary>
3699 ## <param name="domain">
3700 ##      <summary>
3701 ##      Domain allowed access.
3702 ##      </summary>
3703 ## </param>
3704 #
3705 interface(`userdom_stream_connect',`
3706         gen_require(`
3707                 type user_tmp_t;
3708                 attribute userdomain;
3709         ')
3710
3711         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3712 ')
3713
3714 ########################################
3715 ## <summary>
3716 ##      Ptrace user domains.
3717 ## </summary>
3718 ## <param name="domain">
3719 ##      <summary>
3720 ##      Domain allowed access.
3721 ##      </summary>
3722 ## </param>
3723 #
3724 interface(`userdom_ptrace_all_users',`
3725         gen_require(`
3726                 attribute userdomain;
3727         ')
3728
3729         allow $1 userdomain:process ptrace;
3730 ')
3731
3732 ########################################
3733 ## <summary>
3734 ##      dontaudit Search /root
3735 ## </summary>
3736 ## <param name="domain">
3737 ##      <summary>
3738 ##      Domain to not audit.
3739 ##      </summary>
3740 ## </param>
3741 #
3742 interface(`userdom_dontaudit_search_admin_dir',`
3743         gen_require(`
3744                 type admin_home_t;
3745         ')
3746
3747         dontaudit $1 admin_home_t:dir search_dir_perms;
3748 ')
3749
3750 ########################################
3751 ## <summary>
3752 ##      dontaudit list /root
3753 ## </summary>
3754 ## <param name="domain">
3755 ##      <summary>
3756 ##      Domain to not audit.
3757 ##      </summary>
3758 ## </param>
3759 #
3760 interface(`userdom_dontaudit_list_admin_dir',`
3761         gen_require(`
3762                 type admin_home_t;
3763         ')
3764
3765         dontaudit $1 admin_home_t:dir list_dir_perms;
3766 ')
3767
3768 ########################################
3769 ## <summary>
3770 ##      Allow domain to  list /root
3771 ## </summary>
3772 ## <param name="domain">
3773 ##      <summary>
3774 ##      Domain allowed access.
3775 ##      </summary>
3776 ## </param>
3777 #
3778 interface(`userdom_list_admin_dir',`
3779         gen_require(`
3780                 type admin_home_t;
3781         ')
3782
3783         allow $1 admin_home_t:dir list_dir_perms;
3784 ')
3785
3786 ########################################
3787 ## <summary>
3788 ##      Allow Search /root
3789 ## </summary>
3790 ## <param name="domain">
3791 ##      <summary>
3792 ##      Domain allowed access.
3793 ##      </summary>
3794 ## </param>
3795 #
3796 interface(`userdom_search_admin_dir',`
3797         gen_require(`
3798                 type admin_home_t;
3799         ')
3800
3801         allow $1 admin_home_t:dir search_dir_perms;
3802 ')
3803
3804 ########################################
3805 ## <summary>
3806 ##      RW unpriviledged user SysV sempaphores.
3807 ## </summary>
3808 ## <param name="domain">
3809 ##      <summary>
3810 ##      Domain allowed access.
3811 ##      </summary>
3812 ## </param>
3813 #
3814 interface(`userdom_rw_semaphores',`
3815         gen_require(`
3816                 attribute unpriv_userdomain;
3817         ')
3818
3819         allow $1 unpriv_userdomain:sem rw_sem_perms;
3820 ')
3821
3822 ########################################
3823 ## <summary>
3824 ##      Send a message to unpriv users over a unix domain
3825 ##      datagram socket.
3826 ## </summary>
3827 ## <param name="domain">
3828 ##      <summary>
3829 ##      Domain allowed access.
3830 ##      </summary>
3831 ## </param>
3832 #
3833 interface(`userdom_dgram_send',`
3834         gen_require(`
3835                 attribute unpriv_userdomain;
3836         ')
3837
3838         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3839 ')
3840
3841 ######################################
3842 ## <summary>
3843 ##      Send a message to users over a unix domain
3844 ##      datagram socket.
3845 ## </summary>
3846 ## <param name="domain">
3847 ##      <summary>
3848 ##      Domain allowed access.
3849 ##      </summary>
3850 ## </param>
3851 #
3852 interface(`userdom_users_dgram_send',`
3853         gen_require(`
3854                  attribute userdomain;
3855       ')
3856
3857        allow $1 userdomain:unix_dgram_socket sendto;
3858 ')
3859
3860 #######################################
3861 ## <summary>
3862 ##      Allow execmod on files in homedirectory
3863 ## </summary>
3864 ## <param name="domain">
3865 ##      <summary>
3866 ##      Domain allowed access.
3867 ##      </summary>
3868 ## </param>
3869 ## <rolebase/>
3870 #
3871 interface(`userdom_execmod_user_home_files',`
3872         gen_require(`
3873                 type user_home_type;
3874         ')
3875
3876         allow $1 user_home_type:file execmod;
3877 ')
3878
3879 ########################################
3880 ## <summary>
3881 ##      Read admin home files.
3882 ## </summary>
3883 ## <param name="domain">
3884 ##      <summary>
3885 ##      Domain allowed access.
3886 ##      </summary>
3887 ## </param>
3888 ## <rolecap/>
3889 #
3890 interface(`userdom_read_admin_home_files',`
3891         gen_require(`
3892                 type admin_home_t;
3893         ')
3894
3895         read_files_pattern($1, admin_home_t, admin_home_t)
3896 ')
3897
3898 ########################################
3899 ## <summary>
3900 ##      Execute admin home files.
3901 ## </summary>
3902 ## <param name="domain">
3903 ##      <summary>
3904 ##      Domain allowed access.
3905 ##      </summary>
3906 ## </param>
3907 ## <rolecap/>
3908 #
3909 interface(`userdom_exec_admin_home_files',`
3910         gen_require(`
3911                 type admin_home_t;
3912         ')
3913
3914         exec_files_pattern($1, admin_home_t, admin_home_t)
3915 ')
3916
3917 ########################################
3918 ## <summary>
3919 ##      Append files inherited
3920 ##      in the /root directory.
3921 ## </summary>
3922 ## <param name="domain">
3923 ##      <summary>
3924 ##      Domain allowed access.
3925 ##      </summary>
3926 ## </param>
3927 #
3928 interface(`userdom_inherit_append_admin_home_files',`
3929         gen_require(`
3930                 type admin_home_t;
3931         ')
3932
3933         allow $1 admin_home_t:file { getattr append };
3934 ')
3935
3936
3937 #######################################
3938 ## <summary>
3939 ##      Manage all files/directories in the homedir
3940 ## </summary>
3941 ## <param name="userdomain">
3942 ##      <summary>
3943 ##      The user domain
3944 ##      </summary>
3945 ## </param>
3946 ## <rolebase/>
3947 #
3948 interface(`userdom_manage_user_home_content',`
3949         gen_require(`
3950                 type user_home_dir_t, user_home_t;
3951                 attribute user_home_type;
3952         ')
3953
3954         files_list_home($1)
3955         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3956         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3957         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3958         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3959         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3960         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
3961
3962 ')
3963
3964
3965 ########################################
3966 ## <summary>
3967 ##      Create objects in a user home directory
3968 ##      with an automatic type transition to
3969 ##      the user home file type.
3970 ## </summary>
3971 ## <param name="domain">
3972 ##      <summary>
3973 ##      Domain allowed access.
3974 ##      </summary>
3975 ## </param>
3976 ## <param name="object_class">
3977 ##      <summary>
3978 ##      The class of the object to be created.
3979 ##      </summary>
3980 ## </param>
3981 #
3982 interface(`userdom_user_home_dir_filetrans_pattern',`
3983         gen_require(`
3984                 type user_home_dir_t, user_home_t;
3985         ')
3986
3987         type_transition $1 user_home_dir_t:$2 user_home_t;
3988 ')
3989
3990 ########################################
3991 ## <summary>
3992 ##      Create objects in the /root directory
3993 ##      with an automatic type transition to
3994 ##      a specified private type.
3995 ## </summary>
3996 ## <param name="domain">
3997 ##      <summary>
3998 ##      Domain allowed access.
3999 ##      </summary>
4000 ## </param>
4001 ## <param name="private_type">
4002 ##      <summary>
4003 ##      The type of the object to create.
4004 ##      </summary>
4005 ## </param>
4006 ## <param name="object_class">
4007 ##      <summary>
4008 ##      The class of the object to be created.
4009 ##      </summary>
4010 ## </param>
4011 #
4012 interface(`userdom_admin_home_dir_filetrans',`
4013         gen_require(`
4014                 type admin_home_t;
4015         ')
4016
4017         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4018 ')
4019
4020 ########################################
4021 ## <summary>
4022 ##      Send signull to unprivileged user domains.
4023 ## </summary>
4024 ## <param name="domain">
4025 ##      <summary>
4026 ##      Domain allowed access.
4027 ##      </summary>
4028 ## </param>
4029 #
4030 interface(`userdom_signull_unpriv_users',`
4031         gen_require(`
4032                 attribute unpriv_userdomain;
4033         ')
4034
4035         allow $1 unpriv_userdomain:process signull;
4036 ')
4037
4038 ########################################
4039 ## <summary>
4040 ##      Write all users files in /tmp
4041 ## </summary>
4042 ## <param name="domain">
4043 ##      <summary>
4044 ##      Domain allowed access.
4045 ##      </summary>
4046 ## </param>
4047 #
4048 interface(`userdom_write_user_tmp_dirs',`
4049         gen_require(`
4050                 type user_tmp_t;
4051         ')
4052
4053         write_files_pattern($1, user_tmp_t, user_tmp_t)
4054 ')
4055
4056 ########################################
4057 ## <summary>
4058 ##      Manage keys for all user domains.
4059 ## </summary>
4060 ## <param name="domain">
4061 ##      <summary>
4062 ##      Domain allowed access.
4063 ##      </summary>
4064 ## </param>
4065 #
4066 interface(`userdom_manage_all_users_keys',`
4067         gen_require(`
4068                 attribute userdomain;
4069         ')
4070
4071         allow $1 userdomain:key manage_key_perms;
4072 ')
4073
4074
4075 ########################################
4076 ## <summary>
4077 ##      Do not audit attempts to read and write
4078 ##      unserdomain stream.
4079 ## </summary>
4080 ## <param name="domain">
4081 ##      <summary>
4082 ##      Domain to not audit.
4083 ##      </summary>
4084 ## </param>
4085 #
4086 interface(`userdom_dontaudit_rw_stream',`
4087         gen_require(`
4088                 attribute userdomain;
4089         ')
4090
4091         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4092 ')
4093
4094 ########################################
4095 ## <summary>
4096 ##      Do not audit attempts to read and write
4097 ##      unserdomain datagram socket.
4098 ## </summary>
4099 ## <param name="domain">
4100 ##      <summary>
4101 ##      Domain to not audit.
4102 ##      </summary>
4103 ## </param>
4104 #
4105 interface(`userdom_dontaudit_rw_dgram_socket',`
4106         gen_require(`
4107                 attribute userdomain;
4108         ')
4109
4110         dontaudit $1 userdomain:unix_dgram_socket { read write };
4111 ')
4112
4113 ########################################
4114 ## <summary>
4115 ##      Append files
4116 ##      in a user home subdirectory.
4117 ## </summary>
4118 ## <param name="domain">
4119 ##      <summary>
4120 ##      Domain allowed access.
4121 ##      </summary>
4122 ## </param>
4123 #
4124 interface(`userdom_append_user_home_content_files',`
4125         gen_require(`
4126                 type user_home_dir_t, user_home_t;
4127         ')
4128
4129         append_files_pattern($1, user_home_t, user_home_t)
4130         allow $1 user_home_dir_t:dir search_dir_perms;
4131         files_search_home($1)
4132 ')
4133
4134 ########################################
4135 ## <summary>
4136 ##      Read files inherited
4137 ##      in a user home subdirectory.
4138 ## </summary>
4139 ## <param name="domain">
4140 ##      <summary>
4141 ##      Domain allowed access.
4142 ##      </summary>
4143 ## </param>
4144 #
4145 interface(`userdom_read_inherited_user_home_content_files',`
4146         gen_require(`
4147                 attribute user_home_type;
4148         ')
4149
4150         allow $1 user_home_type:file { getattr read };
4151 ')
4152
4153 ########################################
4154 ## <summary>
4155 ##      Append files inherited
4156 ##      in a user home subdirectory.
4157 ## </summary>
4158 ## <param name="domain">
4159 ##      <summary>
4160 ##      Domain allowed access.
4161 ##      </summary>
4162 ## </param>
4163 #
4164 interface(`userdom_inherit_append_user_home_content_files',`
4165         gen_require(`
4166                 type user_home_t;
4167         ')
4168
4169         allow $1 user_home_t:file { getattr append };
4170 ')
4171
4172 ########################################
4173 ## <summary>
4174 ##      Append files inherited
4175 ##      in a user tmp files.
4176 ## </summary>
4177 ## <param name="domain">
4178 ##      <summary>
4179 ##      Domain allowed access.
4180 ##      </summary>
4181 ## </param>
4182 #
4183 interface(`userdom_inherit_append_user_tmp_files',`
4184         gen_require(`
4185                 type user_tmp_t;
4186         ')
4187
4188         allow $1 user_tmp_t:file { getattr append };
4189 ')
4190
4191 ######################################
4192 ## <summary>
4193 ##      Read audio files in the users homedir.
4194 ## </summary>
4195 ## <param name="domain">
4196 ##      <summary>
4197 ##      Domain allowed access.
4198 ##      </summary>
4199 ## </param>
4200 ## <rolecap/>
4201 #
4202 interface(`userdom_read_home_audio_files',`
4203         gen_require(`
4204                 type audio_home_t;
4205         ')
4206
4207         userdom_search_user_home_dirs($1)
4208         allow $1 audio_home_t:dir list_dir_perms;
4209         read_files_pattern($1, audio_home_t, audio_home_t)
4210         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4211 ')
4212
4213 ########################################
4214 ## <summary>
4215 ##      Do not audit attempts to write all user home content files.
4216 ## </summary>
4217 ## <param name="domain">
4218 ##      <summary>
4219 ##      Domain to not audit.
4220 ##      </summary>
4221 ## </param>
4222 #
4223 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4224         gen_require(`
4225                 attribute user_home_type;
4226         ')
4227
4228         dontaudit $1 user_home_type:file write_file_perms;
4229 ')
4230
4231 ########################################
4232 ## <summary>
4233 ##      Do not audit attempts to write all user tmp content files.
4234 ## </summary>
4235 ## <param name="domain">
4236 ##      <summary>
4237 ##      Domain to not audit.
4238 ##      </summary>
4239 ## </param>
4240 #
4241 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4242         gen_require(`
4243                 attribute user_tmp_type;
4244         ')
4245
4246         dontaudit $1 user_tmp_type:file write_file_perms;
4247 ')
4248
4249 ########################################
4250 ## <summary>
4251 ##      Manage all user temporary content.
4252 ## </summary>
4253 ## <param name="domain">
4254 ##      <summary>
4255 ##      Domain allowed access.
4256 ##      </summary>
4257 ## </param>
4258 #
4259 interface(`userdom_manage_all_user_tmp_content',`
4260         gen_require(`
4261                 attribute user_tmp_type;
4262         ')
4263
4264         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4265         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4266         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4267         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4268         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4269         files_search_tmp($1)
4270 ')
4271
4272 ########################################
4273 ## <summary>
4274 ##      List all user temporary content.
4275 ## </summary>
4276 ## <param name="domain">
4277 ##      <summary>
4278 ##      Domain allowed access.
4279 ##      </summary>
4280 ## </param>
4281 #
4282 interface(`userdom_list_all_user_tmp_content',`
4283         gen_require(`
4284                 attribute user_tmp_type;
4285         ')
4286
4287         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4288         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4289         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4290         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4291         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4292         files_search_var($1)
4293         files_search_tmp($1)
4294 ')
4295
4296 ########################################
4297 ## <summary>
4298 ##      Manage all user tmpfs content.
4299 ## </summary>
4300 ## <param name="domain">
4301 ##      <summary>
4302 ##      Domain allowed access.
4303 ##      </summary>
4304 ## </param>
4305 #
4306 interface(`userdom_manage_all_user_tmpfs_content',`
4307         gen_require(`
4308                 attribute user_tmpfs_type;
4309         ')
4310
4311         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4312         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4313         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4314         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4315         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4316         fs_search_tmpfs($1)
4317 ')
4318
4319 ########################################
4320 ## <summary>
4321 ##      Delete all user temporary content.
4322 ## </summary>
4323 ## <param name="domain">
4324 ##      <summary>
4325 ##      Domain allowed access.
4326 ##      </summary>
4327 ## </param>
4328 #
4329 interface(`userdom_delete_all_user_tmp_content',`
4330         gen_require(`
4331                 attribute user_tmp_type;
4332         ')
4333
4334         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4335         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4336         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4337         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4338         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4339         # /var/tmp
4340         files_search_var($1)
4341         files_delete_tmp_dir_entry($1)
4342 ')
4343
4344 ########################################
4345 ## <summary>
4346 ##      Read system SSL certificates in the users homedir.
4347 ## </summary>
4348 ## <param name="domain">
4349 ##      <summary>
4350 ##      Domain allowed access.
4351 ##      </summary>
4352 ## </param>
4353 #
4354 interface(`userdom_read_home_certs',`
4355         gen_require(`
4356                 type home_cert_t;
4357         ')
4358
4359         userdom_search_user_home_content($1)
4360         allow $1 home_cert_t:dir list_dir_perms;
4361         read_files_pattern($1, home_cert_t, home_cert_t)
4362         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4363 ')
4364
4365 #######################################
4366 ## <summary>
4367 ##  Dontaudit Write system SSL certificates in the users homedir.
4368 ## </summary>
4369 ## <param name="domain">
4370 ##  <summary>
4371 ##      Domain to not audit.
4372 ##  </summary>
4373 ## </param>
4374 #
4375 interface(`userdom_dontaudit_write_home_certs',`
4376     gen_require(`
4377         type home_cert_t;
4378     ')
4379
4380     dontaudit $1 home_cert_t:file write;
4381 ')
4382
4383 ########################################
4384 ## <summary>
4385 ##      dontaudit Search getatrr /root files
4386 ## </summary>
4387 ## <param name="domain">
4388 ##      <summary>
4389 ##      Domain to not audit.
4390 ##      </summary>
4391 ## </param>
4392 #
4393 interface(`userdom_dontaudit_getattr_admin_home_files',`
4394         gen_require(`
4395                 type admin_home_t;
4396         ')
4397
4398         dontaudit $1 admin_home_t:file getattr;
4399 ')
4400
4401 ########################################
4402 ## <summary>
4403 ##      dontaudit read /root lnk files
4404 ## </summary>
4405 ## <param name="domain">
4406 ##      <summary>
4407 ##      Domain to not audit.
4408 ##      </summary>
4409 ## </param>
4410 #
4411 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4412         gen_require(`
4413                 type admin_home_t;
4414         ')
4415
4416         dontaudit $1 admin_home_t:lnk_file read;
4417 ')
4418
4419 ########################################
4420 ## <summary>
4421 ##      dontaudit read /root files
4422 ## </summary>
4423 ## <param name="domain">
4424 ##      <summary>
4425 ##      Domain to not audit.
4426 ##      </summary>
4427 ## </param>
4428 #
4429 interface(`userdom_dontaudit_read_admin_home_files',`
4430         gen_require(`
4431                 type admin_home_t;
4432         ')
4433
4434         dontaudit $1 admin_home_t:file read_file_perms;
4435 ')
4436
4437 ########################################
4438 ## <summary>
4439 ##      Create, read, write, and delete user
4440 ##      temporary chr files.
4441 ## </summary>
4442 ## <param name="domain">
4443 ##      <summary>
4444 ##      Domain allowed access.
4445 ##      </summary>
4446 ## </param>
4447 #
4448 interface(`userdom_manage_user_tmp_chr_files',`
4449         gen_require(`
4450                 type user_tmp_t;
4451         ')
4452
4453         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4454         files_search_tmp($1)
4455 ')
4456
4457 ########################################
4458 ## <summary>
4459 ##      Create, read, write, and delete user
4460 ##      temporary blk files.
4461 ## </summary>
4462 ## <param name="domain">
4463 ##      <summary>
4464 ##      Domain allowed access.
4465 ##      </summary>
4466 ## </param>
4467 #
4468 interface(`userdom_manage_user_tmp_blk_files',`
4469         gen_require(`
4470                 type user_tmp_t;
4471         ')
4472
4473         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4474         files_search_tmp($1)
4475 ')
4476
4477 ########################################
4478 ## <summary>
4479 ##      Dontaudit attempt to set attributes on  user temporary directories.
4480 ## </summary>
4481 ## <param name="domain">
4482 ##      <summary>
4483 ##      Domain to not audit.
4484 ##      </summary>
4485 ## </param>
4486 #
4487 interface(`userdom_dontaudit_setattr_user_tmp',`
4488         gen_require(`
4489                 type user_tmp_t;
4490         ')
4491
4492         dontaudit $1 user_tmp_t:dir setattr;
4493 ')
4494
4495 ########################################
4496 ## <summary>
4497 ##      Write all inherited users files in /tmp
4498 ## </summary>
4499 ## <param name="domain">
4500 ##      <summary>
4501 ##      Domain allowed access.
4502 ##      </summary>
4503 ## </param>
4504 #
4505 interface(`userdom_write_inherited_user_tmp_files',`
4506         gen_require(`
4507                 type user_tmp_t;
4508         ')
4509
4510         allow $1 user_tmp_t:file write;
4511 ')
4512
4513 ########################################
4514 ## <summary>
4515 ##      Delete all users files in /tmp
4516 ## </summary>
4517 ## <param name="domain">
4518 ##      <summary>
4519 ##      Domain allowed access.
4520 ##      </summary>
4521 ## </param>
4522 #
4523 interface(`userdom_delete_user_tmp_files',`
4524         gen_require(`
4525                 type user_tmp_t;
4526         ')
4527
4528         allow $1 user_tmp_t:file delete_file_perms;
4529 ')
4530
4531 ########################################
4532 ## <summary>
4533 ##      Delete user tmpfs files.
4534 ## </summary>
4535 ## <param name="domain">
4536 ##      <summary>
4537 ##      Domain allowed access.
4538 ##      </summary>
4539 ## </param>
4540 #
4541 interface(`userdom_delete_user_tmpfs_files',`
4542         gen_require(`
4543                 type user_tmpfs_t;
4544         ')
4545
4546         allow $1 user_tmpfs_t:file delete_file_perms;
4547 ')
4548
4549 ########################################
4550 ## <summary>
4551 ##      Read/Write unpriviledged user SysV shared
4552 ##      memory segments.
4553 ## </summary>
4554 ## <param name="domain">
4555 ##      <summary>
4556 ##      Domain allowed access.
4557 ##      </summary>
4558 ## </param>
4559 #
4560 interface(`userdom_rw_unpriv_user_shared_mem',`
4561         gen_require(`
4562                 attribute unpriv_userdomain;
4563         ')
4564
4565         allow $1 unpriv_userdomain:shm rw_shm_perms;
4566 ')
4567
4568 ########################################
4569 ## <summary>
4570 ##      Do not audit attempts to search user
4571 ##      temporary directories.
4572 ## </summary>
4573 ## <param name="domain">
4574 ##      <summary>
4575 ##      Domain to not audit.
4576 ##      </summary>
4577 ## </param>
4578 #
4579 interface(`userdom_dontaudit_search_user_tmp',`
4580         gen_require(`
4581                 type user_tmp_t;
4582         ')
4583
4584         dontaudit $1 user_tmp_t:dir search_dir_perms;
4585 ')
4586
4587 ########################################
4588 ## <summary>
4589 ##      Execute a file in a user home directory
4590 ##      in the specified domain.
4591 ## </summary>
4592 ## <desc>
4593 ##      <p>
4594 ##      Execute a file in a user home directory
4595 ##      in the specified domain.
4596 ##      </p>
4597 ##      <p>
4598 ##      No interprocess communication (signals, pipes,
4599 ##      etc.) is provided by this interface since
4600 ##      the domains are not owned by this module.
4601 ##      </p>
4602 ## </desc>
4603 ## <param name="domain">
4604 ##      <summary>
4605 ##      Domain allowed access.
4606 ##      </summary>
4607 ## </param>
4608 ## <param name="target_domain">
4609 ##      <summary>
4610 ##      The type of the new process.
4611 ##      </summary>
4612 ## </param>
4613 #
4614 interface(`userdom_domtrans_user_home',`
4615         gen_require(`
4616                 type user_home_t;
4617         ')
4618
4619         read_lnk_files_pattern($1, user_home_t, user_home_t)
4620         domain_transition_pattern($1, user_home_t, $2)
4621         type_transition $1 user_home_t:process $2;
4622 ')
4623
4624 ########################################
4625 ## <summary>
4626 ##      Execute a file in a user tmp directory
4627 ##      in the specified domain.
4628 ## </summary>
4629 ## <desc>
4630 ##      <p>
4631 ##      Execute a file in a user tmp directory
4632 ##      in the specified domain.
4633 ##      </p>
4634 ##      <p>
4635 ##      No interprocess communication (signals, pipes,
4636 ##      etc.) is provided by this interface since
4637 ##      the domains are not owned by this module.
4638 ##      </p>
4639 ## </desc>
4640 ## <param name="domain">
4641 ##      <summary>
4642 ##      Domain allowed access.
4643 ##      </summary>
4644 ## </param>
4645 ## <param name="target_domain">
4646 ##      <summary>
4647 ##      The type of the new process.
4648 ##      </summary>
4649 ## </param>
4650 #
4651 interface(`userdom_domtrans_user_tmp',`
4652         gen_require(`
4653                 type user_tmp_t;
4654         ')
4655
4656         files_search_tmp($1)
4657         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4658         domain_transition_pattern($1, user_tmp_t, $2)
4659         type_transition $1 user_tmp_t:process $2;
4660 ')
4661
4662 ########################################
4663 ## <summary>
4664 ##      Do not audit attempts to read all user home content files.
4665 ## </summary>
4666 ## <param name="domain">
4667 ##      <summary>
4668 ##      Domain to not audit.
4669 ##      </summary>
4670 ## </param>
4671 #
4672 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4673         gen_require(`
4674                 attribute user_home_type;
4675         ')
4676
4677         dontaudit $1 user_home_type:file read_file_perms;
4678 ')
4679
4680 ########################################
4681 ## <summary>
4682 ##      Do not audit attempts to read all user tmp content files.
4683 ## </summary>
4684 ## <param name="domain">
4685 ##      <summary>
4686 ##      Domain to not audit.
4687 ##      </summary>
4688 ## </param>
4689 #
4690 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4691         gen_require(`
4692                 attribute user_tmp_type;
4693         ')
4694
4695         dontaudit $1 user_tmp_type:file read_file_perms;
4696 ')
4697